CVE-2022-27055

Katalog CVE

CVSS 7.5 · High EPSS 1,6%

Kerentanan Incorrect Authorization pada ecjia daojia. Skor CVSS 3.1 7.5 (High) menurut NVD.

Deskripsi (NVD)

ecjia-daojia 1.38.1-20210202629 is vulnerable to information leakage via content/apps/installer/classes/Helper.php. When the web program is installed, a new environment file is created, and the database information is recorded, including the database record password. NOTE: the vendor disputes this because the environment file is in the data directory, which is not intended for access by website visitors (only the statics directory can be accessed by website visitors)

Rincian

Terbit di NVD

19 April 2022

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

7.5 (High), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-863: Incorrect Authorization

EPSS (30 hari)

1,6% peluang dieksploitasi; lebih tinggi dari 75,7% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/ecjia/ecjia-daojia/blob/dfb322387e8d3d50719e44d23d793072616ff789/content/apps/installer/cla... exploit · advisory pihak ketiga
• https://github.com/ecjia/ecjia-daojia/blob/dfb322387e8d3d50719e44d23d793072616ff789/content/apps/installer/cla... exploit · advisory pihak ketiga
• https://github.com/ecjia/ecjia-daojia/issues/20 advisory pihak ketiga