PT-2007-6867 · Pear · Pear Mdb2

Priyadi · Published 2007-11-13 · Updated 2011-03-08 · CVE-2007-5934

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Medium

Base vector

AV:N/AC:M/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions PEAR MDB2 versions prior to 2.5.0a1

Description The issue allows remote attackers to potentially use MDB2 as an indirect proxy or obtain sensitive information by submitting a URL string into a form field in an MDB2 application. This could be achieved by using a file:// URL or a URL for an intranet web site.

Recommendations For versions prior to 2.5.0a1, update to version 2.5.0a1 or later to resolve the issue. As a temporary workaround, consider restricting the interpretation of URL strings in form fields to prevent potential misuse.

Fix

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

CVE-2007-5934

Affected Products

Pear Mdb2

References · 16

• https://nvd.nist.gov/vuln/detail/CVE-2007-5934 · Security Note
• http://security.gentoo.org/glsa/glsa-200712-05.xml · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2007-5934 · Vendor Advisory
• https://redhat.com/archives/fedora-package-announce/2007-November/msg00434.html · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2007-5934 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2007-5934 · Vendor Advisory
• http://marc.info/?l=pear-cvs&m=117823082829114&w=2 · Note
• http://secunia.com/advisories/27572 · Note
• http://secunia.com/advisories/27626 · Note
• http://vupen.com/english/advisories/2007/3806 · Note
• http://osvdb.org/42107 · Note
• http://pear.php.net/bugs/bug.php?id=10024 · Note
• http://pear.php.net/package/MDB2/download/2.5.0a1 · Note
• http://bugs.gentoo.org/show_bug.cgi?id=198446 · Note
• http://securityfocus.com/bid/26382 · Note