CVE-2019-9060: cmsmadesimple cms made simple

csirt@kutim:~/threat-intel/cve/CVE-2019-9060

CVSS 7.5 · High EPSS 1,5%

Kerentanan Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') pada cmsmadesimple cms made simple. Skor CVSS 3.1 7.5 (High) menurut NVD.

Deskripsi (NVD)

An issue was discovered in CMS Made Simple 2.2.8. It is possible to achieve unauthenticated path traversal in the CGExtensions module (in the file action.setdefaulttemplate.php) with the m1_filename parameter; and through the action.showmessage.php file, it is possible to read arbitrary file content (by using that path traversal with m1_prefname set to cg_errormsg and m1_resettodefault=1).

Rincian

Terbit di NVD: 17 September 2021
Terakhir diubah: 17 Juni 2026
Status NVD: Modified
CVSS 3.1: 7.5 (High), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N · uraikan di kalkulator
Jenis kelemahan (CWE): CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
EPSS (30 hari): 1,5% peluang dieksploitasi; lebih tinggi dari 73,8% CVE lain

Produk dan versi terdampak

Vendor	Produk	Versi terdampak
cmsmadesimple	cms made simple	Versi 2.2.8

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

http://dev.cmsmadesimple.org/project/changelog/5819 release notes · advisory vendor
https://forum.cmsmadesimple.org/viewtopic.php?f=1&t=80285 advisory vendor
https://newsletter.cmsmadesimple.org/w/89247Qog4jCRCuRinvhsofwg advisory vendor
https://www.cmsmadesimple.org/2019/03/Announcing-CMS-Made-Simple-v2.2.10-Spuzzum advisory vendor

Sumber: NVD · CVE.org · EPSS. Halaman ini disusun otomatis dari data tersebut; pembaruan terakhir 5 Okt 2026, 20:10 WITA. Kalau sistem di Perangkat Daerah memakai produk ini dan butuh bantuan, laporkan lewat kanal pelaporan.