CVE-2007-6582: Path Traversal

Published Dec 28, 2007

Updated

Directory traversal vulnerability in index.php in mBlog 1.2 allows remote attackers to read arbitrary files via a .. (dot dot) in the page parameter in a page mode action.

Affected Software

1 affected component

C97net Mblog=1.2

Event History

Dec 28, 2007

CVE Published

09:46 PM

Dec 29, 2007

CVE Published

via MITRE·02:00 AM

Data Sourced

via MITRE·02:00 AM

Description

Frequently Asked Questions

What does an attacker need to exploit this issue?

An attacker can exploit the vulnerability remotely by sending a request to index.php with a directory-traversal sequence in the page parameter while using a page mode action. No authentication is required according to the supplied vector.

What is the impact if exploitation succeeds?

Successful exploitation allows reading arbitrary files accessible to the web application. The supplied severity vector indicates confidentiality and integrity impacts, with no availability impact listed.

CVE-2007-6582: Path Traversal

Affected Software

Event History

Frequently Asked Questions

What does an attacker need to exploit this issue?

What is the impact if exploitation succeeds?

Company

Resources

Contact

Frequently Asked Questions

What does an attacker need to exploit this issue?

What is the impact if exploitation succeeds?