CVE-2017-2163 - OpenCVE

Directory traversal vulnerability in SOY CMS Ver.1.8.1 to Ver.1.8.12 allows authenticated attackers to read arbitrary files via shop_id.

No CVSS v3.1

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact None

Availability Impact None

User Interaction None

Access Vector Network

Access Complexity Low

Authentication None

Confidentiality Impact Partial

Integrity Impact None

Availability Impact None

AV:N/AC:L/Au:N/C:P/I:N/A:N

Vendors & Products
CPE Configurations

Vendors	Products
N-i-agroinformatics	Soy Cms

Configuration 1 [-]

OR	cpe:2.3:a:n-i-agroinformatics:soy_cms:1.8.1:::::::*
	cpe:2.3:a:n-i-agroinformatics:soy_cms:1.8.2:::::::*
	cpe:2.3:a:n-i-agroinformatics:soy_cms:1.8.3:::::::*
	cpe:2.3:a:n-i-agroinformatics:soy_cms:1.8.4:::::::*
	cpe:2.3:a:n-i-agroinformatics:soy_cms:1.8.5:::::::*
	cpe:2.3:a:n-i-agroinformatics:soy_cms:1.8.6:::::::*
	cpe:2.3:a:n-i-agroinformatics:soy_cms:1.8.7:::::::*
	cpe:2.3:a:n-i-agroinformatics:soy_cms:1.8.8:::::::*
	cpe:2.3:a:n-i-agroinformatics:soy_cms:1.8.9:::::::*
	cpe:2.3:a:n-i-agroinformatics:soy_cms:1.8.10:::::::*
	cpe:2.3:a:n-i-agroinformatics:soy_cms:1.8.11:::::::*
	cpe:2.3:a:n-i-agroinformatics:soy_cms:1.8.12:::::::*

References

Link	Resource
http://jvn.jp/en/jp/JVN51819749/index.html	Third Party Advisory VDB Entry

History

No history.

MITRE Information

Status: PUBLISHED

Assigner: jpcert

Published: 2017-05-12T18:00:00

Updated: 2017-05-12T17:57:01

Reserved: 2016-12-01T00:00:00

Link: CVE-2017-2163

JSON object: View

NVD Information

Status : Analyzed

Published: 2017-05-12T18:29:00.953

Modified: 2017-05-23T18:46:01.197

Link: CVE-2017-2163

JSON object: View

Redhat Information

No data.

CWE

CWE-22

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:n-i-agroinformatics:soy_cms:1.8.1:*:*:*:*:*:*:*", "matchCriteriaId": "82D060DF-DF3C-4CE9-BC3B-9CC1408A04EC", "vulnerable": true}, {"criteria": "cpe:2.3:a:n-i-agroinformatics:soy_cms:1.8.2:*:*:*:*:*:*:*", "matchCriteriaId": "116BC2BF-44A6-409C-A22F-9361386D60F7", "vulnerable": true}, {"criteria": "cpe:2.3:a:n-i-agroinformatics:soy_cms:1.8.3:*:*:*:*:*:*:*", "matchCriteriaId": "28692E0A-F41B-41E6-8339-566B2BA944E0", "vulnerable": true}, {"criteria": "cpe:2.3:a:n-i-agroinformatics:soy_cms:1.8.4:*:*:*:*:*:*:*", "matchCriteriaId": "90E1A3CF-2671-4E1A-9331-574B923D2DDF", "vulnerable": true}, {"criteria": "cpe:2.3:a:n-i-agroinformatics:soy_cms:1.8.5:*:*:*:*:*:*:*", "matchCriteriaId": "538E250C-5FD5-45C8-A527-2C22BA748ED6", "vulnerable": true}, {"criteria": "cpe:2.3:a:n-i-agroinformatics:soy_cms:1.8.6:*:*:*:*:*:*:*", "matchCriteriaId": "0892384B-4AE4-43E7-BDCC-00F96362A1DC", "vulnerable": true}, {"criteria": "cpe:2.3:a:n-i-agroinformatics:soy_cms:1.8.7:*:*:*:*:*:*:*", "matchCriteriaId": "6E9AD215-0223-4452-B859-0F79F1A55D86", "vulnerable": true}, {"criteria": "cpe:2.3:a:n-i-agroinformatics:soy_cms:1.8.8:*:*:*:*:*:*:*", "matchCriteriaId": "CF504454-B3E8-494A-86D8-AB68A58E0BE1", "vulnerable": true}, {"criteria": "cpe:2.3:a:n-i-agroinformatics:soy_cms:1.8.9:*:*:*:*:*:*:*", "matchCriteriaId": "7F7E980B-9B25-430C-A8FD-EFC59DEE1E8C", "vulnerable": true}, {"criteria": "cpe:2.3:a:n-i-agroinformatics:soy_cms:1.8.10:*:*:*:*:*:*:*", "matchCriteriaId": "4DB22671-D08D-49AF-9D97-EE1435DA9F33", "vulnerable": true}, {"criteria": "cpe:2.3:a:n-i-agroinformatics:soy_cms:1.8.11:*:*:*:*:*:*:*", "matchCriteriaId": "D4E627BF-C070-4076-8582-D3A7E2B9DABD", "vulnerable": true}, {"criteria": "cpe:2.3:a:n-i-agroinformatics:soy_cms:1.8.12:*:*:*:*:*:*:*", "matchCriteriaId": "E2F72D69-24C8-42CF-851E-7BAF5B2612AC", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "descriptions": [{"lang": "en", "value": "Directory traversal vulnerability in SOY CMS Ver.1.8.1 to Ver.1.8.12 allows authenticated attackers to read arbitrary files via shop_id."}, {"lang": "es", "value": "Una vulnerabilidad de salto de directorio en SOY CMS en versiones 1.8.1 a 1.8.12 permite a atacantes autenticados leer archivos arbitrarios mediante shop_id."}], "id": "CVE-2017-2163", "lastModified": "2017-05-23T18:46:01.197", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "MEDIUM", "cvssData": {"accessComplexity": "LOW", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "NONE", "baseScore": 5.0, "confidentialityImpact": "PARTIAL", "integrityImpact": "NONE", "vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:N", "version": "2.0"}, "exploitabilityScore": 10.0, "impactScore": 2.9, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": false}], "cvssMetricV30": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "version": "3.0"}, "exploitabilityScore": 3.9, "impactScore": 3.6, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2017-05-12T18:29:00.953", "references": [{"source": "vultures@jpcert.or.jp", "tags": ["Third Party Advisory", "VDB Entry"], "url": "http://jvn.jp/en/jp/JVN51819749/index.html"}], "sourceIdentifier": "vultures@jpcert.or.jp", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-22"}], "source": "nvd@nist.gov", "type": "Primary"}]}