GHSA-hxcw-pqqc-rv85
Suggest an improvement- Source
- https://github.com/advisories/GHSA-hxcw-pqqc-rv85
- Import Source
- https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/05/GHSA-hxcw-pqqc-rv85/GHSA-hxcw-pqqc-rv85.json
- JSON Data
- https://api.test.osv.dev/v1/vulns/GHSA-hxcw-pqqc-rv85
- Aliases
- Published
- 2022-05-13T01:39:42Z
- Modified
- 2023-11-01T04:49:34.390365Z
- Severity
-
- 9.8 (Critical) CVSS_V3 - CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CVSS Calculator
- Summary
- Anchor CMS Logs Credentials
- Details
-
An issue was discovered in
config/error.phpin Anchor 0.12.3. The error log is exposed at an errors.log URI, and contains MySQL credentials if a MySQL error (such as "Too many connections") has occurred. - Database specific
{ "github_reviewed_at": "2023-07-21T21:45:40Z", "severity": "CRITICAL", "github_reviewed": true, "cwe_ids": [ "CWE-200" ], "nvd_published_at": "2018-02-19T22:29:00Z" }- References
-
- https://nvd.nist.gov/vuln/detail/CVE-2018-7251
- https://github.com/anchorcms/anchor-cms/issues/1247
- https://github.com/anchorcms/anchor-cms
- https://github.com/anchorcms/anchor-cms/releases/tag/0.12.7
- https://twitter.com/finnwea/status/965279233030393856
- http://packetstormsecurity.com/files/154723/Anchor-CMS-0.12.3a-Information-Disclosure.html
- http://www.andmp.com/2018/02/advisory-assigned-CVE-2018-7251-in-anchorcms.html
Affected packages
Packagist / anchorcms/anchor-cms
Package
- Name
- anchorcms/anchor-cms
- Purl
- pkg:composer/anchorcms/anchor-cms