CVEvulnerability
CVE-2008-3924
4.3 MEDIUM
Official page ↗
- Status
- Modified
- Published
- 2008-09-04
- Last modified
- 2026-06-16
- Assigner
- [email protected]
- CVSS 2.0 ([email protected])
- 4.3 MEDIUM — AV:N/AC:M/Au:N/C:P/I:N/A:N
- Weaknesses
- CWE-264
Description
The "Make a backup" functionality in Content Management Made Easy (CMME) 1.12 stores sensitive information under the web root with insufficient access control, which allows remote attackers to discover (1) account names and (2) password hashes via a direct request for (a) backup/cmme_data.zip or (b) backup/cmme_cmme.zip. NOTE: it was later reported that vector a also affects CMME 1.19.
Affected configurations
• hans oesterholt cmme 1.12
Related
Weakness · not in database (1)
References
- http://secunia.com/advisories/31599 Vendor Advisory
- http://securityreason.com/securityalert/4220 securityreason.com
- http://www.securityfocus.com/bid/30854 www.securityfocus.com
- https://exchange.xforce.ibmcloud.com/vulnerabilities/44684 exchange.xforce.ibmcloud.com
- https://www.exploit-db.com/exploits/6313 www.exploit-db.com
- http://secunia.com/advisories/31599 Vendor Advisory
- http://securityreason.com/securityalert/4220 securityreason.com
- http://www.securityfocus.com/bid/30854 www.securityfocus.com
- https://exchange.xforce.ibmcloud.com/vulnerabilities/44684 exchange.xforce.ibmcloud.com
- https://www.exploit-db.com/exploits/6313 www.exploit-db.com