PT-2007-2745 · Kessler Consulting · Webcalendar

Published 2007-03-08 · Updated 2017-07-29 · CVE-2007-1343

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions WebCalendar versions prior to 1.0.5

Description The issue allows remote attackers to set arbitrary global variables via a URL with modified values in the noSet parameter. This could lead to resultant vulnerabilities, including remote file inclusion and other issues.

Recommendations For versions prior to 1.0.5, update to version 1.0.5 or later to resolve the issue. As a temporary workaround, consider restricting access to the includes/functions.php file to minimize the risk of exploitation. Avoid using the noSet parameter in URLs until the issue is resolved.

Fix

Related Identifiers

CVE-2007-1343

DSA-1267-1

Affected Products

Webcalendar

References · 11

• http://debian.org/security/2007/dsa-1267 · Vendor Advisory
• http://sourceforge.net/project/shownotes.php?group_id=3870&release_id=491130 · Patch
• http://webcalendar.cvs.sourceforge.net/webcalendar/webcalendar/includes/functions.php?view=log · Patch
• http://secunia.com/advisories/24403 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2007-1343 · Security Note
• http://webcalendar.cvs.sourceforge.net/webcalendar/webcalendar/includes/functions.php?r1=1.211.2.7&r2=1.211.2.8 · Patch
• http://securityfocus.com/bid/22834 · Vendor Advisory
• http://sourceforge.net/mailarchive/forum.php?thread_id=31840112&forum_id=46247 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/32832 · Note
• http://secunia.com/advisories/24519 · Note
• http://vupen.com/english/advisories/2007/0851 · Note