Unscored severity · published Jun 9, 2014
CVE-2013-2562
Mambo CMS 4.6.5 stores the MySQL database password in cleartext in the document root, which allows local users to obtain sensitive information via unspecified vectors
–
CVSS
0.5%
EPSS
No
On KEV
Description
Mambo CMS 4.6.5 stores the MySQL database password in cleartext in the document root, which allows local users to obtain sensitive information via unspecified vectors.
Exploitation
Is it being used?
Exploit prediction (EPSS)0.5% · higher than 41% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
MC
Mambo Cms · Mambo-foundation
4.6.5 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2013-2562
CVE.org
https://www.cve.org/CVERecord?id=CVE-2013-2562
Exploit
http://packetstormsecurity.com/files/108462/mambocms465-permdosdisclose.txt
seclists.org
http://seclists.org/oss-sec/2013/q1/689
Exploit
http://www.vapid.dhs.org/advisories/mambo_cms_4.6.5.html
More from Mambo Cms
6.1
CVE-2011-2499
Mambo CMS through 4.6.5 has multiple XSS
5.3
CVE-2013-2565
A vulnerability in Mambo CMS v4.6.5 where the scripts thumbs.php, editorFrame.php, editor.php, images.php, manager.php discloses the root path of the webserver
–
CVE-2013-2564
Mambo CMS 4.6.5 allows remote attackers to cause a denial of service (memory and bandwidth consumption) by uploading a crafted file
–
CVE-2013-2563
Mambo CMS 4.6.5 uses world-readable permissions on configuration.php, which allows local users to obtain the admin password hash by reading the file