PT-2007-3955 · Phptodo · Phptodo

Publicado 2007-05-13 · Atualizado 2017-07-29 · CVE-2007-2636

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Média

Vetor base

AV:N/AC:M/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions phpTodo versions prior to 0.8.1

Description The issue allows remote attackers to have an unknown impact via newlines in regular expressions. This can be achieved through several files, including "index.php", "feed.php", "prefs.php", "todolist.php", "classTodoItem.php", and "phpTodoUser.php" in the libs/ directory.

Recommendations For versions prior to 0.8.1, update to version 0.8.1 or later to resolve the issue. As a temporary workaround, consider restricting access to the affected files until the update is applied. Avoid using newlines in regular expressions in the affected API endpoints, such as "index.php", "feed.php", "prefs.php", and "todolist.php", until the issue is resolved.

Correção

Identificadores relacionados

CVE-2007-2636

Produtos afetados

Phptodo

Referências · 5

• http://securityfocus.com/bid/23928 · Nota
• https://exchange.xforce.ibmcloud.com/vulnerabilities/34275 · Nota
• http://phptodo.godshell.com/ChangeLog · Correção
• https://nvd.nist.gov/vuln/detail/CVE-2007-2636 · Nota de Segurança
• http://vupen.com/english/advisories/2007/1774 · Nota