Ubuntu.comUB:CVE-2007-3378CVE-2007-3378
6.8 Medium
CVSS2
Access Vector
NETWORK
Access Complexity
MEDIUM
Authentication
NONE
Confidentiality Impact
PARTIAL
Integrity Impact
PARTIAL
Availability Impact
PARTIAL
AV:N/AC:M/Au:N/C:P/I:P/A:P
0.01 Low
EPSS
Percentile
83.0%
The (1) session_save_path, (2) ini_set, and (3) error_log functions in PHP
4.4.7 and earlier, and PHP 5 5.2.3 and earlier, when invoked from a
.htaccess file, allow remote attackers to bypass safe_mode and open_basedir
restrictions and possibly execute arbitrary commands, as demonstrated using
(a) php_value, (b) php_flag, and Β© directives in .htaccess.
Related
6.8 Medium
CVSS2
Access Vector
NETWORK
Access Complexity
MEDIUM
Authentication
NONE
Confidentiality Impact
PARTIAL
Integrity Impact
PARTIAL
Availability Impact
PARTIAL
AV:N/AC:M/Au:N/C:P/I:P/A:P
0.01 Low
EPSS
Percentile
83.0%