CVE-2022-26159
MediumThe auto-completion plugin in Ametys CMS before 4.5.0 allows a remote unauthenticated attacker to read documents such as plugins/web/service/search/auto-completion//en.xml (and similar pathnames for other languages), which contain all characters typed by all users, including the…
Published Feb 28, 2022 · Updated Nov 21, 2024
Key Facts
Routine patching- CVE-2022-26159 is a medium-severity vulnerability (CVSS 5.3 v3.1) affecting Ametys.
- It is not listed in any known-exploited vulnerabilities catalog. No public exploit code is known.
- EPSS estimates a 13% probability of exploitation in the next 30 days.
- Fixed versions are available, including Ametys 4.5.0.
- Brandefense priority: routine patching, as no exploitation is known and its severity is moderate or low.
CVSS v3.1
5.3
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
EPSS (30-day exploit likelihood)
13%
Higher than 96.3% of all scored CVEs
Exploited in the wild
No known
Not in a known-exploited catalog
Public exploit code
None known
Get the full CVE-2022-26159 brief as a PDF
Every affected product and fixed release, exploitation status and a first 24 hours response checklist, emailed within minutes.
Description
The auto-completion plugin in Ametys CMS before 4.5.0 allows a remote unauthenticated attacker to read documents such as plugins/web/service/search/auto-completion//en.xml (and similar pathnames for other languages), which contain all characters typed by all users, including the content of private pages. For example, a private page may contain usernames, e-mail addresses, and possibly passwords.
Affected Products
1 affected entries in total| Product | Affected versions | Fixed in |
|---|---|---|
| AmetysAmetys | See advisory | 4.5.0 |
Patched Releases
Ametys
4.5.0
Timeline
Publicly disclosed
Feb 28, 2022
Last updated
Nov 21, 2024
Weakness Type
- CWE-425 Direct Request ('Forced Browsing')
References
FAQ
Common Questions.
The auto-completion plugin in Ametys CMS before 4.5.0 allows a remote unauthenticated attacker to read documents such as plugins/web/service/search/auto-completion//en.xml (and similar pathnames for other languages), which contain all characters typed by all users, including the content of private pages.
Affected: Ametys. The full list is in the CVE brief.
It is not listed in any known-exploited vulnerabilities catalog.
No, it is not currently listed in the CISA Known Exploited Vulnerabilities catalog.
No public exploit code is known.
Fixed versions are available, including Ametys 4.5.0.
Brandefense priority: routine patching, as no exploitation is known and its severity is moderate or low.
Is CVE-2022-26159 Running On Your Attack Surface?
Brandefense maps vulnerabilities like this one to your internet-facing assets and tells you exactly where to patch.
Request A Demo