CVE-2014-8790

XML external entity (XXE) vulnerability in admin/api.php in GetSimple CMS 3.1.1 through 3.3.x before 3.3.5 Beta 1, when in certain configurations, allows remote attackers to read arbitrary files via the data parameter.

Affected products

Getsimple Cms

Cagintranetworks Getsimple Cms

= 3.3.3, 3.3.4

Get-simple Getsimple Cms

= 3.1.1, 3.1.2, 3.2, 3.2.1, 3.2.2, 3.2.3, 3.3.0, 3.3.1, 3.3.2

Fix

Available

CVSS 2.0

5.0 MEDIUM

EPSS

2.5% (84th percentile)

NVD status

Modified

Published

2015-01-20