Unscored severity · published Jan 20, 2015
CVE-2014-8790
XML external entity (XXE) vulnerability in admin/api.php in GetSimple CMS 3.1.1 through 3.3.x before 3.3.5 Beta 1, when in certain configurations, allows remote attackers to read…
–
CVSS
2.5%
EPSS
No
On KEV
Description
XML external entity (XXE) vulnerability in admin/api.php in GetSimple CMS 3.1.1 through 3.3.x before 3.3.5 Beta 1, when in certain configurations, allows remote attackers to read arbitrary files via the data parameter.
Exploitation
Is it being used?
Exploit prediction (EPSS)2.5% · higher than 85% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
GC
Getsimple Cms · Cagintranetworks
3.3.3; 3.3.4 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2014-8790
CVE.org
https://www.cve.org/CVERecord?id=CVE-2014-8790
get-simple.info
http://get-simple.info/start/changelog/
Exploit
http://karmainsecurity.com/KIS-2014-17
Exploit
http://packetstormsecurity.com/files/129778/GetSimple-CMS-3.3.4-XML-External-Entity-Injection.html
Exploit
http://seclists.org/fulldisclosure/2014/Dec/135
github.com
https://github.com/GetSimpleCMS/GetSimpleCMS/issues/944
More from Getsimple Cms
8.8
CVE-2017-8081
Poor cryptographic salt initialization in admin/inc/template_functions.php in GetSimple CMS 3.3.13 allows a network attacker to escalate privileges to an arbitrary user or conduct…