CVE-2021-42644

cmseasy V7.7.5_20211012 is affected by an arbitrary file read vulnerability. After login, the configuration file information of the website such as the database configuration file (config / config_database) can be read through this vulnerability.

CVSS v3.1

6.5 MEDIUMCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

CVSS v2.0

4.0 MEDIUMAV:N/AC:L/Au:S/C:P/I:N/A:N

EPSS

0.97% chance of exploitation in the next 30 days, 59th percentile

Published

2022-05-17

Updated

2024-08-04

Proof-of-concept exploits (1)

• https://jdr2021.github.io/2021/10/14/CmsEasy_7.7.5_20211012%E5%AD%98%E5%9C%A8%E4%BB%BB%E6…

References

• CVE Record
• NVD entry

Related

• CVE-2021-42643
• CVE-2021-42659
• CVE-2021-4264
• CVE-2021-42662
• CVE-2021-42627
• CVE-2021-42663