VYPR
← All advisories
Unrated severityOSV Advisory· Published Dec 23, 2018· Updated Aug 5, 2024

CVE-2018-20405

CVE-2018-20405

Description

BigTree 4.3 allows full path disclosure via authenticated admin/news/ input that triggers a syntax error. NOTE: This has been disputed with the following reasoning: "The issue reported requires full developer level access to the content management system where cross site scripting is not an issue -- you already have full control of the CMS including running arbitrary PHP.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

2
  • Bigtreecms/Bigtree CMSOSV2 versions
    4.0beta2, 4.2, 4.2.10, …+ 1 more
    • (no CPE)range: 4.0beta2, 4.2, 4.2.10, …
    • (no CPE)range: =4.3

Patches

Vulnerability mechanics

References

1

News mentions

0

No linked articles in our index yet.