Lucene search

MitreCVE-2007-5389

HistoryOct 12, 2007 - 10:17 a.m.

CVE-2007-5389

2007-10-1210:17:00

CWE-94

mitre

web.nvd.nist.gov

cve-2007-5389

php

remote file inclusion

swmenufree

com_swmenufree

joomla

vulnerability

arbitrary code execution

nvd

mosconfig_absolute_path

CVSS2

6.8

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:M/Au:N/C:P/I:P/A:P

AI Score

7.6

Confidence

High

EPSS

0.015

Percentile

87.3%

JSON

PHP remote file inclusion vulnerability in preview.php in the swMenuFree (com_swmenufree) 4.6 component for Joomla! allows remote attackers to execute arbitrary PHP code via a URL in the mosConfig_absolute_path parameter. NOTE: a reliable third party disputes this issue because preview.php tests a certain constant to prevent direct requests

Affected configurations

Nvd

Node

joomlajoomla

swmenuproswmenufreeMatch4.6

VendorProductVersionCPE
joomlajoomla*cpe:2.3:a:joomla:joomla:*:*:*:*:*:*:*:*
swmenuproswmenufree4.6cpe:2.3:a:swmenupro:swmenufree:4.6:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
joomla	joomla	*	cpe:2.3:a:joomla:joomla::::::::
swmenupro	swmenufree	4.6	cpe:2.3:a:swmenupro:swmenufree:4.6:::::::*

References

osvdb.org/37903

securityreason.com/securityalert/3210

www.attrition.org/pipermail/vim/2007-October/001825.html

www.securityfocus.com/archive/1/482100/100/0/threaded

www.securityfocus.com/archive/1/482165/100/0/threaded

CVSS2

6.8

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:M/Au:N/C:P/I:P/A:P

AI Score

7.6

Confidence

High

EPSS

0.015

Percentile

87.3%

JSON

Related for CVE-2007-5389