Lucene search
HistoryJun 01, 2007 - 10:30 a.m.
CVE-2007-2985
CVSS2
10
Attack Vector
NETWORK
Attack Complexity
LOW
Authentication
NONE
Confidentiality Impact
COMPLETE
Integrity Impact
COMPLETE
Availability Impact
COMPLETE
AV:N/AC:L/Au:N/C:C/I:C/A:C
AI Score
7.8
Confidence
Low
EPSS
0.022
Percentile
89.5%
Pheap 2.0 allows remote attackers to bypass authentication by setting a pheap_login cookie value to the administrator’s username, which can be used to (1) obtain sensitive information, including the administrator password, via settings.php or (2) upload and execute arbitrary PHP code via an update_doc action in edit.php.
Affected configurations
Node
pheappheapMatch2.0
Related
prion
prion
Authentication flaw
2007-06-01 10:30:00
cvelist
cvelist
CVE-2007-2985
2007-06-01 10:00:00
cve
cve
CVE-2007-2985
2007-06-01 10:30:00
exploitdb
exploitdb
Pheap 2.0 - Authentication Bypass / Remote Code Execution
2007-05-29 00:00:00
CVSS2
10
Attack Vector
NETWORK
Attack Complexity
LOW
Authentication
NONE
Confidentiality Impact
COMPLETE
Integrity Impact
COMPLETE
Availability Impact
COMPLETE
AV:N/AC:L/Au:N/C:C/I:C/A:C
AI Score
7.8
Confidence
Low
EPSS
0.022
Percentile
89.5%
Related for NVD:CVE-2007-2985