PT-2007-5813 · Cgi Rescue · Cgi Rescue Shopping Basket Professional

Published 2007-09-04 · Updated 2017-07-29 · CVE-2007-4655

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Medium

Base vector

AV:N/AC:L/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions: CGI RESCUE Shopping Basket Professional versions 7.51 and earlier

Description: The issue allows remote attackers to list arbitrary directories and possibly read arbitrary files due to directory traversal vulnerabilities. This can be achieved by using directory traversal sequences in unspecified parameters to API endpoints such as "list.cgi" or "list2.cgi".

Recommendations: For versions 7.51 and earlier, consider restricting access to the "list.cgi" and "list2.cgi" API endpoints until a fix is available. As a temporary workaround, avoid using unspecified parameters in these endpoints to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this issue.

Fix

Path traversal

Information Disclosure

Weakness Enumeration

CWE-22

CWE-200

Related Identifiers

CVE-2007-4655

Affected Products

Cgi Rescue Shopping Basket Professional

References · 8

• http://secunia.com/advisories/26614 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2007-4655 · Security Note
• http://securityfocus.com/bid/25500 · Note
• http://osvdb.org/40147 · Note
• http://jvn.jp/jp/JVN%2320452446/index.html · Note
• http://rescue.ne.jp/whatsnew/blog.cgi/permalink/20070823212803 · Note
• http://osvdb.org/40146 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/36389 · Note