CVE-2024-5735

Full Path Disclosure in AdmirorFrames Joomla! Extension

Full Path Disclosure vulnerability in AdmirorFrames Joomla! extension in afHelper.php script allows an unauthorised attacker to retrieve location of web root folder. This issue affects AdmirorFrames: before 5.0.

Affected

Nikola Vasilijevski · AdmirorFrames

CVSS v4.0 CERT

6.3 MEDIUMCVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:Y/R:U/V:D/RE:L/U:Green

CVSS v3.1 NVD

7.5 HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

EPSS

1.52% chance of exploitation in the next 30 days, 74th percentile

Published

2024-06-28

Updated

2024-08-01

Proof-of-concept exploits (1)

• afine-com/CVE-2024-57350★ · 2024-06-28

Security advisories

• https://cert.pl/en/posts/2024/06/CVE-2024-5735
• https://cert.pl/posts/2024/06/CVE-2024-5735
• sectroyer/CVEs/tree/main/CVE-2024-5735
• vasiljevski/admirorframes/issues/3

References

• CVE Record
• NVD entry

Related

• CVE-2018-25031
• CVE-2022-35501
• CVE-2022-36433
• CVE-2023-35840
• CVE-2023-39062
• CVE-2023-45182