PT-2007-2745 · Kessler Consulting · Webcalendar

Publicado 2007-03-08 · Atualizado 2017-07-29 · CVE-2007-1343

Positive Technologies (AI Summary)

CVSS v2.0

7.5

Alta

Vetor base

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions WebCalendar versions prior to 1.0.5

Description The issue allows remote attackers to set arbitrary global variables via a URL with modified values in the noSet parameter. This could lead to resultant vulnerabilities, including remote file inclusion and other issues.

Recommendations For versions prior to 1.0.5, update to version 1.0.5 or later to resolve the issue. As a temporary workaround, consider restricting access to the includes/functions.php file to minimize the risk of exploitation. Avoid using the noSet parameter in URLs until the issue is resolved.

Correção

Identificadores relacionados

CVE-2007-1343

DSA-1267-1

Produtos afetados

Webcalendar

Referências · 11

• http://debian.org/security/2007/dsa-1267 · Aviso do Fabricante
• http://sourceforge.net/project/shownotes.php?group_id=3870&release_id=491130 · Correção
• http://sourceforge.net/mailarchive/forum.php?thread_id=31840112&forum_id=46247 · Nota
• http://webcalendar.cvs.sourceforge.net/webcalendar/webcalendar/includes/functions.php?view=log · Correção
• http://secunia.com/advisories/24403 · Aviso do Fabricante
• https://exchange.xforce.ibmcloud.com/vulnerabilities/32832 · Nota
• http://secunia.com/advisories/24519 · Nota
• http://vupen.com/english/advisories/2007/0851 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2007-1343 · Nota de Segurança
• http://webcalendar.cvs.sourceforge.net/webcalendar/webcalendar/includes/functions.php?r1=1.211.2.7&r2=1.211.2.8 · Correção
• http://securityfocus.com/bid/22834 · Aviso do Fabricante