Permissions, Privileges, and Access Controls in Advanced Access Manager - #VU20944
Published: September 9, 2019
Vulnerability identifier: #VU20944
CSH Severity: Low
CVSS v4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]
CVE-ID: N/A
CWE-ID: CWE-264
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to gain access to sensitive information.
The vulnerability exists due to the application does not check user's permissions and allows to download any file on the website. A remote authenticated attacker can download arbitrary files from within the website directory root and gain access to sensitive information.
Affected software
Advanced Access Manager
Remediation
Install updates from vendor's website.
Advanced Access Manager - update to 5.9.9