漏洞描述
Ametys CMS before 4.5.0 allows a remote unauthenticated attacker to read documents such as plugins/web/service/search/auto-completion/domain/en.xml (and similar pathnames for other languages) via the auto-completion plugin, which contain all characters typed by all users, including the content of private pages. For example, a private page may contain usernames, e-mail addresses, and possibly passwords.
影响产品
修复建议
建议关注厂商安全公告，及时升级至已修复版本，并结合实际资产暴露情况采取缓解措施。
参考链接
nvd.nist.govhttps://nvd.nist.gov/vuln/detail/CVE-2022-26159↗podalirius.nethttps://podalirius.net/en/cves/2022-26159/↗issues.ametys.orghttps://issues.ametys.org/browse/CMS-10973↗github.comhttps://github.com/p0dalirius/CVE-2022-26159-Ametys-Autocompletion-XML/↗github.comhttps://github.com/ARPSyndicate/cvemon↗