Lucene search

[email protected]CVE-2007-1035

HistoryFeb 21, 2007 - 11:28 a.m.

CVE-2007-1035

2007-02-2111:28:00

NVD-CWE-Other

[email protected]

web.nvd.nist.gov

cve-2007-1035

drupal

mediafield

audio modules

remote attackers

arbitrary files

arbitrary directories

6.9 Medium

AI Score

Confidence

Low

7.5 High

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:P/I:P/A:P

0.025 Low

EPSS

Percentile

89.9%

JSON

Unspecified vulnerability in certain demonstration scripts in getID3 1.7.1, as used in the Mediafield and Audio modules for Drupal, allows remote attackers to read and delete arbitrary files, list arbitrary directories, and write to empty files or .mp3 files via unknown vectors.

CPENameOperatorVersion
drupal:mediafield_moduledrupal mediafield moduleeq*
drupal:getid3drupal getid3eq1.7.1
drupal:audio_moduledrupal audio moduleeq*

CPE	Name	Operator	Version
drupal:mediafield_module	drupal mediafield module	eq	*
drupal:getid3	drupal getid3	eq	1.7.1
drupal:audio_module	drupal audio module	eq	*

References

blamcast.net/articles/highly-critical-security-flaws-in-drupal-audio-module

drupal.org/node/119385

osvdb.org/35161

www.securityfocus.com/bid/22587

www.vupen.com/english/advisories/2007/0635

exchange.xforce.ibmcloud.com/vulnerabilities/32542

6.9 Medium

AI Score

Confidence

Low

7.5 High

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:P/I:P/A:P

0.025 Low

EPSS

Percentile

89.9%

JSON

Related for CVE-2007-1035

prion1 nessus1 securityvulns1