Vulnerability in Cagintranetworks Getsimple Cms
CVE-2014-8790
XML external entity (XXE) vulnerability in admin/api.php in GetSimple CMS 3.1.1 through 3.3.x before 3.3.5 Beta 1, when in certain configurations, allows remote attackers to read arbitrary files via the data parameter.
EPSS: 0.025 (83.3th percentile) — read the EPSS interpretation.
Affected products
- Cagintranetworks Getsimple_cms — versions 3.3.3, 3.3.4
- Get-simple Getsimple_cms — versions 3.1.1, 3.1.2, 3.2
- N/a — versions n/a
References
- cve@mitre.org (mailing-list, Exploit, x_refsource_FULLDISC)
- cve@mitre.org (Exploit, x_refsource_MISC)
- cve@mitre.org (x_refsource_CONFIRM)
- cve@mitre.org (Exploit, x_refsource_MISC)
- cve@mitre.org (x_refsource_CONFIRM)