6.4

CVE-2007-1364

Exploit
DropAFew before 0.2.1 does not require authorization for certain privileged actions, which allows remote attackers to (1) view the logged calorie information of arbitrary users via the id parameter in editlogcal.php, (2) add arbitrary links via links.php, or (3) create arbitrary users via newaccount2.php.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Dropafew ≫ Dropafew Version <= 0.2
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 2.25% 0.806
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
nvd@nist.gov 6.4 10 4.9
AV:N/AC:L/Au:N/C:P/I:P/A:N
Es wurden noch keine Informationen zu CWE veröffentlicht.
http://secunia.com/advisories/24861
Vendor Advisory
http://www.dropafew.com/sphpblog/comments.php?y=07&m=04&entry=entry070403-224437
Patch
http://www.securityfocus.com/bid/23400
Exploit
https://exchange.xforce.ibmcloud.com/vulnerabilities/33561
https://www.cynops.de/advisories/CVE-2007-1363.txt
Vendor Advisory