title: Local File Inclusion in Axiell Iguana CMS
description: A Local File Inclusion vulnerability has been found in Axiell Iguana CMS. Due to insufficient neutralisation of user input on the url parameter on the Proxy.type.php endpoint, external users are capable of accessing files on the server.
problem types: CWE-552 Files or Directories Accessible to External Parties
affected:
{
defaultStatus: unaffected
platforms: [Windows, Linux]
product: Iguana
vendor: Axiell
versions:
status: affected, version: < 4.5.02
}
metrics:
cvssV3_1: [
attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 9.8
baseSeverity: CRITICAL
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
version: 3.1
]
format: CVSS
scenarios: GENERAL
solutions: Upgrade to the latest version of Iguana CMS.