CVE-2005-3766 Missing authorization in n/a

Medium 5.0 Published 22 Nov 2005 Updated 7 Aug 2024

Attackers can access sensitive user pages by browsing uploaded files due to insufficient access control in Exponent CMS.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: None listed

What is CVE-2005-3766?

CVE-2005-3766 is a medium-severity missing authorization vulnerability in n/a, published on 22 Nov 2005. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

Exponent CMS 0.96.3 and later versions stores sensitive user pages under the web document root with insufficient access control even though certain permissions are specified, which allows attackers to access the pages by browsing uploaded files.

Which versions are affected by CVE-2005-3766?

It affects 1 product.

Products include Exponent Exponent.

How do I fix CVE-2005-3766?

No fix has been published for CVE-2005-3766 yet. Limit exposure of the affected software until one is available.

Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.

Is CVE-2005-3766 being exploited?

There is no known exploitation of CVE-2005-3766 in the wild and no public exploit code.

Sources

Also known as GHSA-v87m-2q74-9xw3.