PT-2007-4823 · Mysql Server · Mysqldumper

Publicado 2007-07-05 · Atualizado 2018-10-30 · CVE-2007-3567

Positive Technologies (AI Summary)

CVSS v2.0

7.5

Alta

Vetor base

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions MySQLDumper versions 1.21b through 1.23 REV227

Description The issue allows remote attackers to bypass authentication requirements via HTTP POST requests due to the use of a "Limit GET" statement in the .htaccess authentication mechanism.

Recommendations For versions 1.21b through 1.23 REV227, consider modifying the .htaccess file to properly restrict access to both GET and POST requests as a temporary workaround. Restrict access to the authentication mechanism to minimize the risk of exploitation.

Exploit

Correção

Identificadores relacionados

CVE-2007-3567

Produtos afetados

Mysqldumper

Referências · 8

• 🔥 http://securityfocus.com/bid/24759 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2007-3567 · Nota de Segurança
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-3567 · Nota
• https://exchange.xforce.ibmcloud.com/vulnerabilities/35291 · Nota
• http://securityfocus.com/archive/1/472756/100/0/threaded · Nota
• http://archives.neohapsis.com/archives/bugtraq/2007-08/0052.html · Nota
• http://osvdb.org/42460 · Nota
• http://securityreason.com/securityalert/2859 · Nota