CVE-2018-6910

EPSS 19.0%

Vexday Risk Score

23Low

SSVC decision (CISA)

Attend

PoC available → attend closely

Exploit maturity

Functional exploit

Automatable exploit available (Nuclei/Metasploit).

CVSS —EPSS 19.0%KEV nãoPoC —Nuclei simMetasploit —Patch —

Lifecycle

13 Feb 2018Published on NVD

Recommendation: Plan a near-term fix — a public PoC already exists.

DedeCMS 5.7 allows remote attackers to discover the full path via a direct request for include/downmix.inc.php or inc/inc_archives_functions.php.

Affected products

References