CVE-2014-8706
Pluck CMS 4.7.2 allows remote attackers to obtain sensitive information by (1) changing "PHPSESSID" to an array; (2) adding non-alphanumeric chars to "PHPSESSID"; (3) changing the image parameter to an array; or (4) changing the image parameter to a…
Does this matter?
Lower severity and a low EPSS score (1.11%). Track it; it rarely justifies an emergency change on its own.
Description
Pluck CMS 4.7.2 allows remote attackers to obtain sensitive information by (1) changing "PHPSESSID" to an array; (2) adding non-alphanumeric chars to "PHPSESSID"; (3) changing the image parameter to an array; or (4) changing the image parameter to a string, which reveals the installation path in an error message.
- CVSS 3.0
- 5.3 MEDIUMCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
- EPSS
- 1.11% probability · 64th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-200
- Affected
- pluck-cms/pluck
- Source
- cve@mitre.org
References
- http://rossmarks.uk/portfolio.phpThird Party Advisory
- http://rossmarks.uk/whitepapers/pluck_cms_4.7.txtExploit
- http://rossmarks.uk/portfolio.phpThird Party Advisory
- http://rossmarks.uk/whitepapers/pluck_cms_4.7.txtExploit
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.