CVE-2007-2266: Critical severity Progress Webspeed Messenger vulnerability

Published Apr 25, 2007

Updated

Progress Webspeed Messenger allows remote attackers to read, create, modify, and execute arbitrary files by invoking webutil/cpyfile.p in the WService parameter to (1) cgiip.exe or (2) wsisa.dll in scripts/, as demonstrated by using the save,editor options to create a new file using the fileName parameter.

Affected Software

1 affected component

Progress Webspeed Messenger

Event History

Apr 25, 2007

CVE Published

08:19 PM

Apr 26, 2007

CVE Published

via MITRE·12:00 AM

Data Sourced

via MITRE·12:00 AM

Description

Frequently Asked Questions

What is the severity of CVE-2007-2266?

CVE-2007-2266 is considered a high severity vulnerability due to its potential for remote attackers to compromise system security.

How do I fix CVE-2007-2266?

Fixing CVE-2007-2266 involves updating Progress Webspeed Messenger to the latest version that addresses this vulnerability.

What types of attacks can be performed using CVE-2007-2266?

Using CVE-2007-2266, attackers can read, create, modify, and execute arbitrary files remotely.

Which version of Progress Webspeed Messenger is affected by CVE-2007-2266?

CVE-2007-2266 affects all versions of Progress Webspeed Messenger prior to the patch release that resolves this vulnerability.

How can I mitigate the risks associated with CVE-2007-2266?

Mitigation for CVE-2007-2266 includes restricting access to the web services and applying security updates provided by Progress.