PT-2007-6867 · Pear · Pear Mdb2

Priyadi · Publicado 2007-11-13 · Atualizado 2011-03-08 · CVE-2007-5934

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Média

Vetor base

AV:N/AC:M/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions PEAR MDB2 versions prior to 2.5.0a1

Description The issue allows remote attackers to potentially use MDB2 as an indirect proxy or obtain sensitive information by submitting a URL string into a form field in an MDB2 application. This could be achieved by using a file:// URL or a URL for an intranet web site.

Recommendations For versions prior to 2.5.0a1, update to version 2.5.0a1 or later to resolve the issue. As a temporary workaround, consider restricting the interpretation of URL strings in form fields to prevent potential misuse.

Correção

Information Disclosure

Enumeração de Fraquezas

CWE-200

Identificadores relacionados

CVE-2007-5934

Produtos afetados

Pear Mdb2

Referências · 16

• https://nvd.nist.gov/vuln/detail/CVE-2007-5934 · Nota de Segurança
• http://marc.info/?l=pear-cvs&m=117823082829114&w=2 · Nota
• http://secunia.com/advisories/27572 · Nota
• http://secunia.com/advisories/27626 · Nota
• http://vupen.com/english/advisories/2007/3806 · Nota
• http://osvdb.org/42107 · Nota
• http://security.gentoo.org/glsa/glsa-200712-05.xml · Aviso do Fabricante
• http://pear.php.net/bugs/bug.php?id=10024 · Nota
• http://pear.php.net/package/MDB2/download/2.5.0a1 · Nota
• https://security-tracker.debian.org/tracker/CVE-2007-5934 · Aviso do Fabricante
• https://redhat.com/archives/fedora-package-announce/2007-November/msg00434.html · Aviso do Fabricante
• http://bugs.gentoo.org/show_bug.cgi?id=198446 · Nota
• http://securityfocus.com/bid/26382 · Nota
• https://osv.dev/vulnerability/DEBIAN-CVE-2007-5934 · Aviso do Fabricante
• http://secunia.com/advisories/27983 · Nota