PT-2007-6663 · Litespeed · Litespeed Web Server

Tr3Mbl3R · Publicado 2007-10-23 · Atualizado 2017-09-29 · CVE-2007-5654

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Média

Vetor base

AV:N/AC:L/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions LiteSpeed Web Server versions prior to 3.2.4

Description The issue allows remote attackers to trigger the use of an arbitrary MIME type for a file. This can be achieved by including a "%00." sequence followed by a new extension in a request. For example, an attacker could read PHP source code by requesting .php%00.txt files.

Recommendations For versions prior to 3.2.4, update to version 3.2.4 or later to resolve the issue. As a temporary workaround, consider restricting access to sensitive files and directories to minimize the risk of exploitation.

Exploit

Correção

Information Disclosure

Enumeração de Fraquezas

CWE-200

Identificadores relacionados

CVE-2007-5654

Produtos afetados

Litespeed Web Server

Referências · 8

• 🔥 https://exploit-db.com/exploits/4556 · Exploit
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-5654 · Nota
• http://securityfocus.com/bid/26163 · Nota
• http://secunia.com/advisories/27302 · Nota
• http://osvdb.org/41867 · Nota
• http://litespeedtech.com/latest/litespeed-web-server-3.2.4-released.html · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2007-5654 · Nota de Segurança
• https://exchange.xforce.ibmcloud.com/vulnerabilities/37380 · Nota