CVE-2018-20405

2018-12-2323:00:00

mitre

github.com

AI Score

3.7

Confidence

High

SSVC

Exploitation

poc

Automatable

Technical Impact

partial

JSON

BigTree 4.3 allows full path disclosure via authenticated admin/news/ input that triggers a syntax error. NOTE: This has been disputed with the following reasoning: "The issue reported requires full developer level access to the content management system where cross site scripting is not an issue – you already have full control of the CMS including running arbitrary PHP.

ADP Affected

[
  {
    "cpes": [
      "cpe:2.3:a:bigtreecms:bigtree:4.3:*:*:*:*:*:*:*"
    ],
    "vendor": "bigtreecms",
    "product": "bigtree",
    "versions": [
      {
        "status": "affected",
        "version": "4.3"
      }
    ],
    "defaultStatus": "unknown"
  }
]