PT-2007-6392 · Pegasus Imaging · Imagxpress

Published 2007-10-09 · Updated 2017-07-29 · CVE-2007-5320

Positive Technologies (AI Summary)

CVSS v2.0

4.0

Medium

Base vector

AV:N/AC:H/Au:N/C:N/I:P/A:P

Name of the Vulnerable Software and Affected Versions: Pegasus Imaging ImagXpress version 8.0

Description: The issue allows remote attackers to perform absolute path traversal attacks. This can be achieved in two ways: (1) by deleting arbitrary files via the CacheFile attribute in the ThumbnailXpress.1 ActiveX control, or (2) by overwriting arbitrary files via the CompactFile function in the ImagXpress.8 ActiveX control.

Recommendations: For Pegasus Imaging ImagXpress version 8.0, consider disabling the ThumbnailXpress.1 and ImagXpress.8 ActiveX controls to prevent exploitation until a patch is available. Restrict access to the CacheFile attribute and the CompactFile function to minimize the risk of arbitrary file deletion or overwrite. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2007-5320

Affected Products

Imagxpress

References · 11

• 🔥 http://securityfocus.com/bid/25948 · Exploit
• 🔥 https://exploit-db.com/exploits/4488 · Exploit
• 🔥 http://shinnai.altervista.org/exploits/txt/TXT_3DQ1nIkI6zmWCek4zP5U.html · Exploit
• 🔥 http://shinnai.altervista.org/exploits/txt/TXT_wfv7ZG0G6KnQlk1SieLd.html · Exploit
• http://secunia.com/advisories/27095 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2007-5320 · Security Note
• http://vupen.com/english/advisories/2007/3388 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/37012 · Note
• http://osvdb.org/37959 · Note
• http://securityfocus.com/bid/25949 · Note
• http://osvdb.org/37960 · Note