medium6.5Public exploit code
CVE-2017-15639
tasks/feed/readRSS.cfm in Mura CMS before 6.2 allows attackers to bypass intended access restrictions by leveraging the "draggable feeds" feature.
Public exploit code
Working exploit or proof of concept code has been published for this vulnerability. Treat unpatched systems as at risk.
- Mura CMS < 6.2 - Server-Side Request Forgery / XML External Entity Injection2017-10-24 · webapps · cfm
Impact
tasks/feed/readRSS.cfm in Mura CMS before 6.2 allows attackers to bypass intended access restrictions by leveraging the "draggable feeds" feature.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Getmura | Mura Cms | through 6.1 |
Weakness classification
References
- NVD record
- CVE.org record
- http://www.getmura.com/blog/critical-security-update-for-mura-cms-version-6-1-and-earlier/
- http://www.securityfocus.com/bid/101603
- https://www.exploit-db.com/exploits/43045/
- http://www.getmura.com/blog/critical-security-update-for-mura-cms-version-6-1-and-earlier/
- http://www.securityfocus.com/bid/101603
- https://www.exploit-db.com/exploits/43045/