PT-2007-7182 · Barracuda Networks · Barracudadrive Web Server

Published 2007-12-12 · Updated 2018-10-15 · CVE-2007-6314

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Medium

Base vector

AV:N/AC:L/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions BarracudaDrive Web Server versions prior to 3.8

Description The issue allows remote attackers to read the source code for web scripts by manipulating the file name in the URL. This can be achieved by appending specific characters, such as a plus (+), a dot (.), or similar characters like %80, to the file name.

Recommendations For versions prior to 3.8, update to version 3.8 or later to resolve the issue. As a temporary workaround, consider restricting access to sensitive web scripts until the update is applied.

Exploit

Fix

RCE

Weakness Enumeration

CWE-20

Related Identifiers

CVE-2007-6314

Affected Products

Barracudadrive Web Server

References · 8

• 🔥 http://securityfocus.com/bid/26805 · Exploit
• 🔥 http://aluigi.altervista.org/adv/barradrive-adv.txt · Exploit
• 🔥 https://exploit-db.com/exploits/4713 · Exploit
• http://secunia.com/advisories/28032 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2007-6314 · Security Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/38972 · Note
• http://securityfocus.com/archive/1/484833/100/0/threaded · Note
• http://securityreason.com/securityalert/3434 · Note