PT-2007-4537 · Calendarix · Calendarix

Published 2007-06-27 · Updated 2017-07-29 · CVE-2007-3258

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Medium

Base vector

AV:N/AC:L/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions Calendarix version 0.7.20070307

Description The issue allows remote attackers to obtain sensitive information by providing large values to the year and month parameters in calendar.php. This causes negative values to be passed to the mktime library call, resulting in the revelation of the installation path in the error message.

Recommendations For Calendarix version 0.7.20070307, consider validating and sanitizing the year and month parameters to prevent large values from being passed to the mktime library call. As a temporary workaround, restrict access to the calendar.php file to minimize the risk of exploitation.

Fix

Related Identifiers

CVE-2007-3258

Affected Products

Calendarix

References · 7

• http://netvigilance.com/advisory0035 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2007-3258 · Security Note
• http://marc.info/?l=full-disclosure&m=118279031307874&w=2 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/35047 · Note
• http://marc.info/?l=bugtraq&m=118279128017628&w=2 · Note
• http://osvdb.org/35371 · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-3258 · Note