PT-2007-4537 · Calendarix · Calendarix

Publicado 2007-06-27 · Atualizado 2017-07-29 · CVE-2007-3258

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Média

Vetor base

AV:N/AC:L/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions Calendarix version 0.7.20070307

Description The issue allows remote attackers to obtain sensitive information by providing large values to the year and month parameters in calendar.php. This causes negative values to be passed to the mktime library call, resulting in the revelation of the installation path in the error message.

Recommendations For Calendarix version 0.7.20070307, consider validating and sanitizing the year and month parameters to prevent large values from being passed to the mktime library call. As a temporary workaround, restrict access to the calendar.php file to minimize the risk of exploitation.

Correção

Identificadores relacionados

CVE-2007-3258

Produtos afetados

Calendarix

Referências · 7

• http://marc.info/?l=full-disclosure&m=118279031307874&w=2 · Nota
• http://netvigilance.com/advisory0035 · Aviso do Fabricante
• https://exchange.xforce.ibmcloud.com/vulnerabilities/35047 · Nota
• http://marc.info/?l=bugtraq&m=118279128017628&w=2 · Nota
• http://osvdb.org/35371 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2007-3258 · Nota de Segurança
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-3258 · Nota