CVE-2014-5107 - CVE House
Back to Database
Status published Medium CVE-2014-5107

concrete5 before 5.6.3 allows remote attackers to obtain the installation...

Vulnerability Description

concrete5 before 5.6.3 allows remote attackers to obtain the installation path via a direct request to (1) system/basics/editor.php, (2) system/view.php, (3) system/environment/file_storage_locations.php, (4) system/mail/importers.php, (5) system/mail/method.php, (6) system/permissions/file_types.php, (7) system/permissions/files.php, (8) system/permissions/tasks.php, (9) system/permissions/users.php, (10) system/seo/view.php, (11) view.php, (12) users/attributes.php, (13) scrapbook/view.php, (14) pages/attributes.php, (15) files/attributes.php, or (16) files/search.php in single_pages/dashboard/.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2014-5107

Credits & Attribution

No credits recorded in the NVD database.

References

More from concrete5

View All →
CVE-2017-6908
An issue was discovered in concrete5 <= 5.6.3.4. The vulnerability...
Medium 6.1
CVE-2017-6905
An issue was discovered in concrete5 <= 5.6.3.4. The vulnerability...
Medium 6.1
CVE-2015-3989
Multiple cross-site scripting (XSS) vulnerabilities in concrete5 before 5.7.4 allow...
Medium 4.3
CVE-2015-2250
Multiple cross-site scripting (XSS) vulnerabilities in concrete5 before 5.7.4 allow...
Medium 4.3
CVE-2014-9526
Multiple cross-site scripting (XSS) vulnerabilities in concrete5 5.7.2.1, 5.7.2, and...
Medium 4.3

Affected Vendor

Affected Software

concrete5, concrete cms
Vulnerable Versions:
5.5.0, 5.5.1, 5.5.2, 5.5.2.1, 5.6.0, 5.6.0.1, 5.6.0.2, 5.4.2, 5.4.2.1, 5.4.2.2, 5.6.1, 5.6.1.1, 5.6.1.2, 5.6.2, 5.6.2.1

Timeline

Official Publish: July 28th, 2014
Last Modified: September 17th, 2024
Added to House: July 19th, 2026

CVSS Vectors

Weaknesses (CWE)

No CWE data available

MITRE ATT&CK TTPs

No associated TTPs found for this vulnerability.