PT-2007-4748 · Hewlett Packard · Hp Photo Digital Imaging

Callax · Published 2007-06-29 · Updated 2018-10-16 · CVE-2007-3487

Positive Technologies (AI Summary)

CVSS v2.0

6.4

Medium

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:N

Name of the Vulnerable Software and Affected Versions Hewlett-Packard (HP) Photo Digital Imaging version 2.0.0.133

Description The issue concerns an absolute path traversal in a certain ActiveX control in the hpqxml.dll file, which allows remote attackers to create or overwrite arbitrary files. This is achieved by manipulating the argument to the saveXMLAsFile method.

Recommendations For version 2.0.0.133, consider restricting access to the saveXMLAsFile method until a patch is available. Additionally, avoid using the saveXMLAsFile method with untrusted input to minimize the risk of exploitation.

Exploit

Fix

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2007-3487

Affected Products

Hp Photo Digital Imaging

References · 7

• 🔥 https://exploit-db.com/exploits/4119 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2007-3487 · Security Note
• http://secunia.com/advisories/25869 · Vendor Advisory
• https://exchange.xforce.ibmcloud.com/vulnerabilities/35124 · Note
• http://osvdb.org/37675 · Note
• http://securityfocus.com/archive/1/472384/100/0/threaded · Note
• http://securityreason.com/securityalert/2846 · Note