PT-2007-5813 · Cgi Rescue · Cgi Rescue Shopping Basket Professional

Publicado 2007-09-04 · Atualizado 2017-07-29 · CVE-2007-4655

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Média

Vetor base

AV:N/AC:L/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions: CGI RESCUE Shopping Basket Professional versions 7.51 and earlier

Description: The issue allows remote attackers to list arbitrary directories and possibly read arbitrary files due to directory traversal vulnerabilities. This can be achieved by using directory traversal sequences in unspecified parameters to API endpoints such as "list.cgi" or "list2.cgi".

Recommendations: For versions 7.51 and earlier, consider restricting access to the "list.cgi" and "list2.cgi" API endpoints until a fix is available. As a temporary workaround, avoid using unspecified parameters in these endpoints to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this issue.

Correção

Path traversal

Information Disclosure

Enumeração de Fraquezas

CWE-22

CWE-200

Identificadores relacionados

CVE-2007-4655

Produtos afetados

Cgi Rescue Shopping Basket Professional

Referências · 8

• http://securityfocus.com/bid/25500 · Nota
• http://secunia.com/advisories/26614 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2007-4655 · Nota de Segurança
• http://osvdb.org/40147 · Nota
• http://jvn.jp/jp/JVN%2320452446/index.html · Nota
• http://rescue.ne.jp/whatsnew/blog.cgi/permalink/20070823212803 · Nota
• http://osvdb.org/40146 · Nota
• https://exchange.xforce.ibmcloud.com/vulnerabilities/36389 · Nota