CVE-2020-14017

7.5 highEPSS 1.2%

High (7.5) in naviwebs navigate cms. EPSS 1.2% chance of exploitation in the next 30 days.

An issue was discovered in Navigate CMS 2.9 r1433. Sessions, as well as associated information such as CSRF tokens, are stored in cleartext files in the directory /private/sessions. An unauthenticated user could use a brute-force approach to attempt to identify existing sessions, or view the contents of this file to discover details about a session.

Severity

CVSS 3.1

7.5 high

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

EPSS: 1.2% chance of exploitation in the next 30 days; higher than 67% of CVEs (scores of 2026-10-31)
CWE: CWE-312
Published: 2020-06-24
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

naviwebs:navigate_cms

References

https://blog.sean-wright.com/navigate-cms/
https://blog.sean-wright.com/navigate-cms/

Check your stack JSON