Vulnerability Details : CVE-2006-3936
system/workplace/editors/editor.jsp in Alkacon OpenCms before 6.2.2 allows remote authenticated users to read the source code of arbitrary JSP files by specifying the file in the resource parameter, as demonstrated using index.jsp.
Products affected by CVE-2006-3936
- cpe:2.3:a:alkacon:opencms:6.0.0:*:*:*:*:*:*:*
- cpe:2.3:a:alkacon:opencms:6.0.2:*:*:*:*:*:*:*
- cpe:2.3:a:alkacon:opencms:6.0.3:*:*:*:*:*:*:*
- cpe:2.3:a:alkacon:opencms:6.0.4:*:*:*:*:*:*:*
- cpe:2.3:a:alkacon:opencms:6.2:*:*:*:*:*:*:*
- cpe:2.3:a:alkacon:opencms:6.2.1:*:*:*:*:*:*:*
Exploit prediction scoring system (EPSS) score for CVE-2006-3936
0.38%
Probability of exploitation activity in the next 30 days
EPSS Score History
~ 74 %
Percentile, the proportion of vulnerabilities that are scored at or less
CVSS scores for CVE-2006-3936
| Base Score | Base Severity | CVSS Vector | Exploitability Score | Impact Score | Score Source | First Seen |
|---|---|---|---|---|---|---|
|
4.0
|
MEDIUM | AV:N/AC:L/Au:S/C:P/I:N/A:N |
8.0
|
2.9
|
NIST |
References for CVE-2006-3936
-
http://www.opencms.org/export/download/opencms/opencms_6.2.2_src.zip
Patch
-
http://www.opencms.org/opencms/en/shownews.html?id=1002
OpenCms 6.2.2 release notesPatch
-
https://exchange.xforce.ibmcloud.com/vulnerabilities/28001
OpenCms editor.jsp information disclosure CVE-2006-3936 Vulnerability Report
-
http://www.securityfocus.com/archive/1/441182/100/0/threaded
-
http://securityreason.com/securityalert/1302
-
http://o0o.nu/~meder/OpenCMS_multiple_vulnerabilities.txt
Exploit
Jump to