CVE-2007-4174

2007-08-0700:00:00

ubuntu.com

5.8 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:N/C:P/I:P/A:N

0.021 Low

EPSS

Percentile

89.2%

JSON

Tor before 0.1.2.16, when ControlPort is enabled, does not properly
restrict commands to localhost port 9051, which allows remote attackers to
modify the torrc configuration file, compromise anonymity, and have other
unspecified impact via HTTP POST data containing commands without valid
authentication, as demonstrated by an HTML form (1) hosted on a web site or
(2) injected by a Tor exit node.