Vulnerability Details : CVE-2006-3936
system/workplace/editors/editor.jsp in Alkacon OpenCms before 6.2.2 allows remote authenticated users to read the source code of arbitrary JSP files by specifying the file in the resource parameter, as demonstrated using index.jsp.
Exploit prediction scoring system (EPSS) score for CVE-2006-3936
Probability of exploitation activity in the next 30 days: 0.27%
Percentile, the proportion of vulnerabilities that are scored at or less: ~ 63 % EPSS Score History EPSS FAQ
CVSS scores for CVE-2006-3936
Base Score | Base Severity | CVSS Vector | Exploitability Score | Impact Score | Score Source |
---|---|---|---|---|---|
4.0
|
MEDIUM | AV:N/AC:L/Au:S/C:P/I:N/A:N |
8.0
|
2.9
|
NIST |
References for CVE-2006-3936
- http://www.opencms.org/export/download/opencms/opencms_6.2.2_src.zip
-
http://www.opencms.org/opencms/en/shownews.html?id=1002
OpenCms 6.2.2 release notesPatch
-
https://exchange.xforce.ibmcloud.com/vulnerabilities/28001
OpenCms editor.jsp information disclosure CVE-2006-3936 Vulnerability Report
- http://www.securityfocus.com/archive/1/441182/100/0/threaded
- http://securityreason.com/securityalert/1302
-
http://o0o.nu/~meder/OpenCMS_multiple_vulnerabilities.txt
Exploit
Products affected by CVE-2006-3936
- cpe:2.3:a:alkacon:opencms:6.0.0:*:*:*:*:*:*:*
- cpe:2.3:a:alkacon:opencms:6.0.2:*:*:*:*:*:*:*
- cpe:2.3:a:alkacon:opencms:6.0.3:*:*:*:*:*:*:*
- cpe:2.3:a:alkacon:opencms:6.0.4:*:*:*:*:*:*:*
- cpe:2.3:a:alkacon:opencms:6.2:*:*:*:*:*:*:*
- cpe:2.3:a:alkacon:opencms:6.2.1:*:*:*:*:*:*:*