CVE-2007-5278: Medium severity Zomplog Zomplog vulnerability

Published Oct 8, 2007

Updated

Zomplog 3.8.1 and earlier stores potentially sensitive information under the web root with insufficient access control, which allows remote attackers to download files that were uploaded by users, as demonstrated by obtaining a directory listing via a direct request to /upload and then retrieving individual files. NOTE: in a non-default configuration, the directory listing is denied, but filenames may be predicable.

Affected Software

1 affected component

Zomplog Zomplog=3.8.1

Remediation

Patch Available

http://www.securityfocus.com/bid/25861

Event History

Oct 8, 2007

CVE Published

11:17 PM

Oct 9, 2007

CVE Published

via MITRE·03:00 AM

Data Sourced

via MITRE·03:00 AM

Description

Frequently Asked Questions

What is the severity of CVE-2007-5278?

CVE-2007-5278 is classified as a medium severity vulnerability due to the potential exposure of sensitive user-uploaded files.

How do I fix CVE-2007-5278?

To fix CVE-2007-5278, ensure that proper access controls are implemented to restrict access to sensitive directories such as /upload.

What type of information is at risk with CVE-2007-5278?

CVE-2007-5278 risks exposing potentially sensitive user-uploaded files due to insufficient access controls.

Which versions of Zomplog are affected by CVE-2007-5278?

CVE-2007-5278 affects Zomplog versions 3.8.1 and earlier.

Can CVE-2007-5278 be exploited remotely?

Yes, CVE-2007-5278 can be exploited remotely, allowing attackers to download files by accessing the vulnerable upload directory.