CVE-2007-6584

CVSS V2 Medium 6.4 CVSS V3 None

Description

Multiple directory traversal vulnerabilities in 1024 CMS 1.3.1 allow remote attackers to include and execute arbitrary local files via a .. (dot dot) in (1) the lang parameter to pages/print/default/ops/news.php or (2) the theme_dir parameter to pages/download/default/ops/search.php; or the admin_theme_dir parameter to (3) download.php, (4) forum.php, or (5) news.php in admin/ops/reports/ops/. NOTE: it was later reported that 1.4.2 beta and earlier are also affected for vector 1.

Overview

CVE ID
CVE-2007-6584

Assigner
cve@mitre.org

Vulnerability Status
Modified

Published Version
2007-12-28T21:46:00

Last Modified Date
2017-09-29T01:30:00

Weakness Enumerations

CWE	URL
CWE-22	http://cwe.mitre.org/data/definitions/22.html

CPE Configuration (Product)

CPE	Vulnerable	Operator
cpe:2.3:a:1024_cms:1024_cms:1.3.1:::::::*	1	OR
cpe:2.3:a:1024_cms:1024_cms:1.4.1:::::::*	1	OR
cpe:2.3:a:1024_cms:1024_cms:1.4.2:::::::*	1	OR
cpe:2.3:a:1024_cms:1024_cms:1.4.2:beta::::::	1	OR

CVSS Version 2

Version
2.0

Vector String
AV:N/AC:L/Au:N/C:P/I:P/A:N

Access Vector
NETWORK

Access Compatibility
LOW

Authentication
NONE

Confidentiality Impact
PARTIAL

Integrity Impact
PARTIAL

Availability Impact
NONE

Base Score
6.4

Severity
MEDIUM

Exploitability Score
10

Impact Score
4.9

References

Reference URL	Reference Tags
http://www.securityfocus.com/bid/28753
http://secunia.com/advisories/29810	Vendor Advisory
http://osvdb.org/41283
http://osvdb.org/41284
http://osvdb.org/41281
http://osvdb.org/41280
http://osvdb.org/41282
https://www.exploit-db.com/exploits/5434
https://www.exploit-db.com/exploits/4765

Sources

Source Name	Source URL
NIST	https://nvd.nist.gov/vuln/detail/CVE-2007-6584
MITRE	https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-6584

History

Created	Old Value	New Value	Data Type	Notes
2022-05-10 08:26:48				Added to TrackCVE