Vulnerability in Exponent

CVE-2005-3763

Exponent CMS 0.96.3 and later versions includes the full installation path in the base parameter to thumb.php, which allows remote attackers to obtain sensitive information. NOTE: this might be resultant from an absolute path traversal vulnerability.

EPSS: 0.014 (69.2th percentile) — read the EPSS interpretation.

Affected products

  • Exponent — versions 0.94, 0.95, 0.96.1
  • N/a — versions n/a

References

  • cve@mitre.org (Vendor Advisory, mailing-list, x_refsource_BUGTRAQ)
  • cve@mitre.org (x_refsource_SECUNIA, Vendor Advisory, third-party-advisory)
  • cve@mitre.org (x_refsource_SECUNIA, third-party-advisory)