Security readout for executives and security teams
Plain-English summary
fipsCMS Light 2.1 can expose its database file from the public web directory. If reachable, an unauthenticated remote user may download the database and read sensitive site data. The provided sources do not identify a vendor patch or confirm active exploitation.
Executive priority
Treat this as a high-priority legacy exposure if fipsCMS Light is still hosted. The main risk is direct data loss, not system takeover. Prioritize discovery, removal from public access, and incident review if exposed.
Technical view
This is an information disclosure issue caused by sensitive data being stored under the web root with insufficient access control. The CVE names fipsCMS Light 2.1 and a directly requestable database file. Product metadata is sparse, and no CVSS or CWE is provided.
Likely exposure
Exposure is most likely on legacy internet-facing fipsCMS Light 2.1 deployments, backups, or migrated sites retaining the vulnerable database placement. The affected-product data in the bundle is incomplete beyond the named version.
Exploitation context
The bundle includes an Exploit-DB reference, so public exploit information exists. CISA KEV is false, and the provided sources do not show confirmed active exploitation in the wild.
Researcher notes
Evidence is limited to the CVE description and two public references. No CVSS, CWE, patch, or exploit-in-the-wild confirmation is included. The core validation question is whether the named database file is publicly retrievable on any asset.
Mitigation direction
- Check whether fipsCMS Light 2.1 is present in production or archived web roots.
- Remove database files from any publicly served directory.
- Apply explicit web-server deny rules for database file types and sensitive directories.
- Check vendor or maintainer guidance for any available fixed release or migration advice.
- Rotate credentials or secrets found in exposed database content.
Validation and detection
- Inventory public web roots for fipsCMS Light files and database artifacts.
- Confirm sensitive database files are not reachable over HTTP or HTTPS.
- Review web access logs for historical requests to the exposed database location.
- Assess downloaded or backed-up copies for credentials, personal data, or administrative records.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
Database behavior lookup
The CVE wording references database injection or access, so collection and exfiltration review may help. This is a Glexia inferred lookup path, not an official MITRE, ATT&CK, or CVE Program mapping.
Open ATT&CK lookupCVE-2009-2022 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Unknown
- CVSS
- Not scored
- Known Exploited
- No
- Published
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS and timeline data
No CVSS vectors or timeline events were available in the normalized CVE source material.
Source materials
- CVE List V5 sourceCVE List V5
- 8890CVE reference · exploit, x_refsource_EXPLOIT-DB
- fipscms-db-info-disclosure(50987)CVE reference · vdb-entry, x_refsource_XF
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.