CVE-2022-27055 Information disclosure in n/a
An attacker can read database credentials from an environment file if the web server is misconfigured to allow access to the data directory.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2022-27055?
CVE-2022-27055 is a high-severity vulnerability in n/a, published on 19 Apr 2022. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
ecjia-daojia 1.38.1-20210202629 is vulnerable to information leakage via content/apps/installer/classes/Helper.php. When the web program is installed, a new environment file is created, and the database information is recorded, including the database record password. NOTE: the vendor disputes this because the environment file is in the data directory, which is not intended for access by website visitors (only the statics directory can be accessed by website visitors)
Weakness: CWE-863
Which versions are affected by CVE-2022-27055?
It affects 1 product.
Products include Ecjia Daojia.
How do I fix CVE-2022-27055?
No fix has been published for CVE-2022-27055 yet. Limit exposure of the affected software until one is available.
Is CVE-2022-27055 being exploited?
There is no known exploitation of CVE-2022-27055 in the wild and no public exploit code.
Sources
Also known as GHSA-352q-cw7r-wrj8.