PT-2005-3600 · Kessler Consulting · Webcalendar

Published 2005-08-29 · Updated 2017-07-11 · CVE-2005-2717

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions WebCalendar versions prior to 1.0.1

Description A remote file inclusion issue allows remote attackers to execute arbitrary PHP code when opening settings.php, possibly via send reminders.php or other scripts.

Recommendations For versions prior to 1.0.1, update to version 1.0.1 or later to resolve the issue. As a temporary workaround, consider restricting access to the settings.php and send reminders.php scripts until a patch is applied.

Fix

Related Identifiers

CVE-2005-2717

DSA-799-1

Affected Products

Webcalendar

References · 9

• https://nvd.nist.gov/vuln/detail/CVE-2005-2717 · Security Note
• http://debian.org/security/2005/dsa-799 · Vendor Advisory
• http://securityfocus.com/bid/14651 · Patch
• http://sourceforge.net/project/shownotes.php?release_id=350336 · Patch
• http://secunia.com/advisories/16675 · Note
• http://securitytracker.com/id?1014849 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/22136 · Note
• http://vupen.com/english/advisories/2005/1513 · Note
• http://secunia.com/advisories/16528 · Note