PT-2007-4534 · Xythos · Xythos Digital Locker+2

Published 2007-06-27 · Updated 2018-10-16 · CVE-2007-3255

Positive Technologies (AI Summary)

CVSS v2.0

6.5

Medium

Base vector

AV:N/AC:L/Au:S/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Xythos Enterprise Document Manager versions prior to 5.0.25.8 Xythos Enterprise Document Manager versions 6.x prior to 6.0.46.1 Xythos Digital Locker versions prior to 5.0.25.8 Xythos Digital Locker versions 6.x prior to 6.0.46.1 Xythos WebFile Server (affected versions not specified)

Description The issue allows remote authenticated users to execute commands as arbitrary users. This can be achieved via a saved Workflow name or the Content-Type HTTP header.

Recommendations For Xythos Enterprise Document Manager versions prior to 5.0.25.8, update to version 5.0.25.8 or later. For Xythos Enterprise Document Manager versions 6.x prior to 6.0.46.1, update to version 6.0.46.1 or later. For Xythos Digital Locker versions prior to 5.0.25.8, update to version 5.0.25.8 or later. For Xythos Digital Locker versions 6.x prior to 6.0.46.1, update to version 6.0.46.1 or later. For Xythos WebFile Server, at the moment, there is no information about a newer version that contains a fix for this issue.

Fix

Related Identifiers

CVE-2007-3255

Affected Products

Xythos Digital Locker

Xythos Enterprise Document Manager

Xythos Webfile Server

References · 11

• https://nvd.nist.gov/vuln/detail/CVE-2007-3255 · Security Note
• http://securityfocus.com/bid/24521 · Patch
• http://securitytracker.com/id?1018291 · Note
• http://osvdb.org/37616 · Note
• http://symantec.com/content/en/us/enterprise/research/SYMSA-2007-004.txt · Note
• http://osvdb.org/37615 · Note
• http://securityfocus.com/archive/1/472275/100/0/threaded · Note
• http://securityreason.com/securityalert/2845 · Note
• http://secunia.com/advisories/25783 · Note
• http://securitytracker.com/id?1018292 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/35084 · Note