CVE-2018-7251: Anchor CMS error log exposes MySQL credentials

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 18 September 2026. Confidence: high.

critical priorityUnauthenticated network access to exposed database credentials with High impact across confidentiality, integrity and availability, plus a very high EPSS score, warrants critical priority.

What it is

Anchor 0.12.3 exposes its error log at an errors.log URI, and that log can contain MySQL credentials when a MySQL error such as "Too many connections" occurs. Because the log is reachable without authentication, any visitor can read database secrets and pivot into the backend database.

Impact

An attacker gains the site's MySQL credentials, enabling direct access to the database for data theft, modification, or destruction. The CVSS 3.0 vector rates confidentiality, integrity and availability impact all High.

Attack surface

Reached over the network by requesting the errors.log URI; no authentication and no user interaction are required per the CVSS vector AV:N/AC:L/PR:N/UI:N. The exposure only yields credentials after a MySQL error has been logged.

Exploitation

Not listed in CISA KEV and no ransomware associations are documented. EPSS is high (0.7183 probability, 0.99395 percentile), and references include third-party advisories and an issue tracker entry, but no reference is tagged as an exploit.

What to do

• Upgrade Anchor to 0.12.7 or later, which the release reference indicates addresses this issue.
• Block or deny web access to errors.log and other log files at the web server or reverse proxy.
• Move logs outside the web root and restrict file permissions to the application user.
• Rotate the MySQL credentials that may have been written to the exposed log.
• Avoid logging database credentials in error output; sanitize error messages.

Detection

• Search web server access logs for requests to errors.log or similar log paths.
• Monitor for direct MySQL connections from unexpected hosts using the application's database account.
• Check for the presence of errors.log inside the web root and review its contents for credential strings.
• Alert on MySQL error conditions such as "Too many connections" that precede log exposure.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.