Description
Wonder CMS 2014 allows remote attackers to obtain sensitive information by logging into the application with an array for the password, which reveals the installation path in an error message.
References (3)
Core 3
Core References
Third Party Advisory, VDB Entry vdb-entry
x_refsource_bid
http://www.securityfocus.com/bid/97192
Third Party Advisory x_refsource_misc
http://rossmarks.uk/portfolio.php
Exploit x_refsource_misc
http://rossmarks.uk/whitepapers/wonder_cms_2014.txt
Scores
CVSS v3
5.3
EPSS
0.0135
EPSS Percentile
68.2%
Attack Vector
NETWORK
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Details
CWE
CWE-200
Status
published
Products (1)
wondercms/wondercms
2014
Published
Mar 17, 2017
Tracked Since
Feb 18, 2026