The "Make a backup" functionality in Content Management Made Easy (CMME) 1.12 stores sensitive information under the web root with insuffic…

Published 18 y ago 2008-09-04 · modified 4 mo ago 2026-06-16 · JSON

CVSS

4.3

v2.0 · NVD

CISA KEV

not known exploited

EPSS

2.3%

percentile 83%

Public exploits

Exploit-DB

The "Make a backup" functionality in Content Management Made Easy (CMME) 1.12 stores sensitive information under the web root with insufficient access control, which allows remote attackers to discover (1) account names and (2) password hashes via a direct request for (a) backup/cmme_data.zip or (b) backup/cmme_cmme.zip. NOTE: it was later reported that vector a also affects CMME 1.19.

Exploit prediction (EPSS)

2.25% probability of exploitation in the next 30 days, higher than 83% of all scored CVEs.

Exploits and detections

EDB-6313 CMME 1.12 - Local File Inclusion / Cross-Site Scripting / Cross-Site Request Forgery/Download Backup/Make Directory · webapps · 2008-08-26

CVSS scores

Assigned by	Version	Score	Vector
NVD	2.0	4.3	`AV:N/AC:M/Au:N/C:P/I:N/A:N`

Classification

Weakness

CWE-264 Permissions, Privileges, and Access Controls

References

exchange.xforce.ibmcloud.com /vulnerabilities/44684 · vdb-entry, x_refsource_XF, x_transferred
secunia.com /advisories/31599 · third-party-advisory, x_refsource_SECUNIA, x_transferred
securityfocus.com /bid/30854 · vdb-entry, x_refsource_BID, x_transferred
securityreason.com /securityalert/4220 · third-party-advisory, x_refsource_SREASON, x_transferred
exploit-db.com /exploits/6313 · exploit, x_refsource_EXPLOIT-DB, x_transferred

Sources

CVE List: CVE-2008-3924
NVD: CVE-2008-3924

vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.