CVE-2018-20405 Information disclosure in n/a
Authenticated administrators can trigger syntax errors to disclose full file paths, though the issue is disputed as requiring high-level access.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2018-20405?
CVE-2018-20405 is a low-severity vulnerability in n/a, published on 23 Dec 2018. An attacker needs administrator access to exploit it, with no action from the victim.
Official description
BigTree 4.3 allows full path disclosure via authenticated admin/news/ input that triggers a syntax error. NOTE: This has been disputed with the following reasoning: "The issue reported requires full developer level access to the content management system where cross site scripting is not an issue -- you already have full control of the CMS including running arbitrary PHP.
Weakness: CWE-639
Which versions are affected by CVE-2018-20405?
It affects 1 product.
Products include Bigtreecms Bigtree.
How do I fix CVE-2018-20405?
No fix has been published for CVE-2018-20405 yet. Limit exposure of the affected software until one is available.
Is CVE-2018-20405 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2018-20405 exists.
Sources
Also known as GHSA-qggm-xmg7-pqpf.