PT-2007-4695 · Webapp · Webapp

Publicado 2007-06-26 · Atualizado 2008-11-15 · CVE-2007-3424

Positive Technologies (AI Summary)

CVSS v2.0

7.5

Alta

Vetor base

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions WebAPP versions prior to 0.9.9.7

Description The issue concerns the moveim function in the instantmessage.pl script, which uses the tocat parameter as a subdirectory name when moving an instant message. This has unknown impact and may be exploitable through remote attack vectors.

Recommendations For versions prior to 0.9.9.7, update to version 0.9.9.7 or later to resolve the issue. As a temporary workaround, consider restricting access to the instantmessage.pl script to minimize the risk of exploitation. Avoid using the tocat parameter in the affected script until the issue is resolved.

Correção

Identificadores relacionados

CVE-2007-3424

Produtos afetados

Webapp

Referências · 4

• http://osvdb.org/45410 · Nota
• http://web-app.org/cgi-bin/index.cgi?action=forum&board=how_to&op=display&num=9458 · Nota
• http://web-app.org/downloads/WebAPPv0.9.9.7.zip · Correção
• https://nvd.nist.gov/vuln/detail/CVE-2007-3424 · Nota de Segurança