CVE-2007-2836

🗓️ 02 Jul 2007 19:00:00Reported by mitreType

Directory traversal vulnerability in Hiki 0.8.0 through 0.8.6 allows remote attackers to delete arbitrary files via directory traversal sequences in the session ID, which is matched against an insufficiently restrictive regular expression before it is used to construct a filename that is marked for deletion at logout

Reporter	Title	Published	Views	Family All 15
ATTACKERKB	CVE-2007-3395	26 Jun 200717:30	–	attackerkb
BDU FSTEC	Vulnerabilities of the Debian GNU/Linux operating system, which allow a remote attacker to compromise the integrity and accessibility of protected information	7 Jul 201600:00	–	bdu_fstec
CVE	CVE-2007-2836	2 Jul 200719:00	–	cve
Debian	[SECURITY] [DSA 1324-1] New hiki packages fix missing input sanitising	28 Jun 200721:04	–	debian
Debian CVE	CVE-2007-2836	2 Jul 200719:00	–	debiancve
Tenable Nessus	Debian DSA-1324-1 : hiki - missing input sanitising	1 Jul 200700:00	–	nessus
EUVD	EUVD-2007-2828	7 Oct 202500:30	–	euvd
Japan Vulnerability Notes	Hiki arbitrary file deletion vulnerability	20 May 200815:00	–	jvn
NVD	CVE-2007-2836	2 Jul 200719:30	–	nvd
OpenVAS	Debian: Security Advisory (DSA-1324-1)	8 Mar 202300:00	–	openvas

Source	Link
vupen	www.vupen.com/english/advisories/2007/2304
jvn	www.jvn.jp/jp/JVN%2305187780/index.html
osvdb	www.osvdb.org/37469
bugs	www.bugs.debian.org/cgi-bin/bugreport.cgi
secunia	www.secunia.com/advisories/25874
hikiwiki	www.hikiwiki.org/en/advisory20070624.html
exchange	www.exchange.xforce.ibmcloud.com/vulnerabilities/35029
hikiwiki	www.hikiwiki.org/hiki-0_8_6.patch
debian	www.debian.org/security/2007/dsa-1324
secunia	www.secunia.com/advisories/25764

28 Jul 2017 12:57Current

6.5Medium risk

Vulners AI Score6.5

EPSS0.00813