CVE-2008-3924 | BDVDB-2026-32263 Detail

Description#

The "Make a backup" functionality in Content Management Made Easy (CMME) 1.12 stores sensitive information under the web root with insufficient access control, which allows remote attackers to discover (1) account names and (2) password hashes via a direct request for (a) backup/cmme_data.zip or (b) backup/cmme_cmme.zip. NOTE: it was later reported that vector a also affects CMME 1.19.

Impact#

No impact statement in the source data.

Weaknesses#

No weakness recorded in the source data.

References#

https://exchange.xforce.ibmcloud.com/vulnerabilities/44684
http://secunia.com/advisories/31599
http://www.securityfocus.com/bid/30854
http://securityreason.com/securityalert/4220
https://www.exploit-db.com/exploits/6313

Exploit#

https://www.exploit-db.com/exploits/6313

History#

Version 12008-09-04Record published in the CVE List.
Version 22024-08-07Most recent update recorded in the CVE List.