PT-2007-6499 · Viart · Viart Shop

Publicado 2007-10-15 · Atualizado 2018-10-15 · CVE-2007-5463

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Média

Vetor base

AV:N/AC:L/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions: ViArt Shop versions 3.3 beta and earlier

Description: The issue in the iDEAL payment module allows remote attackers to obtain the pathname for certificate and key files via an "iDEAL transaction". This could involve error messages for nonexistent files when using fopen. If the certificate or key files are placed under the web document root, this issue can be leveraged to read these sensitive files.

Recommendations: For versions 3.3 beta and earlier, consider restricting access to the ideal process.php file in the iDEAL payment module to minimize the risk of exploitation. Additionally, ensure that certificate and key files are not placed under the web document root to prevent unauthorized access. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Path traversal

Enumeração de Fraquezas

CWE-22

Identificadores relacionados

CVE-2007-5463

Produtos afetados

Viart Shop

Referências · 8

• http://viart.com/ideal_process_script_fix_for_release_32_and_33_beta.html · Correção
• http://securityfocus.com/archive/1/481978/100/0/threaded · Nota
• http://secunia.com/advisories/27199 · Aviso do Fabricante
• https://exchange.xforce.ibmcloud.com/vulnerabilities/37048 · Nota
• http://securityfocus.com/bid/25998 · Nota
• http://securityreason.com/securityalert/3233 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2007-5463 · Nota de Segurança
• http://osvdb.org/40151 · Nota