CVE-2025-40662
BaseFortify
Publication date: 2025-06-10
Last updated on: 2025-10-22
Assigner: Spanish National Cybersecurity Institute, S.A. (INCIBE)
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| acc | dm_corporative_cms | to 2025.01 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-200 | The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information. |
| CWE-NVD-CWE-noinfo |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability is an Absolute Path Disclosure in the DM Corporative CMS. It allows an attacker to view the contents of the webroot/file directory by navigating to a non-existent file, potentially exposing sensitive information about the file system structure. [1]
How can this vulnerability impact me? :
The vulnerability can impact you by exposing sensitive information about the server's file system, which could be used by attackers to plan further attacks or exploit other vulnerabilities. It may lead to information disclosure that compromises the security of your web application. [1]
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability can be detected by attempting to access a non-existent file on the DM Corporative CMS web server and observing if the contents of the webroot/file directory are disclosed. For example, you can use curl or wget to request a non-existent file URL and check the response for path disclosure. Example command: curl -i http://targetsite/path/to/nonexistentfile. If the response reveals absolute path information or directory contents, the vulnerability is present. [1]
What immediate steps should I take to mitigate this vulnerability?
The immediate mitigation step is to upgrade the DM Corporative CMS to version 2025.01 or later, as this vulnerability has been fixed in that release by the Dmacroweb development team. [1]