VulnerabilityModified

CVE-2007-0347

The is_eow function in format.c in CVSTrac before 2.0.1 does not properly check for the "'" (quote) character, which allows remote authenticated users to execute limited SQL injection attacks and cause a denial of service (database error) via a '…

MEDIUM 4.3EPSS 3.69%

Does this matter?

Lower severity and a low EPSS score (3.69%). Track it; it rarely justifies an emergency change on its own.

Description

CVSS 2.0: 4.3 MEDIUMAV:N/AC:M/Au:N/C:N/I:N/A:P
EPSS: 3.69% probability · 89th percentile
CISA KEV: Not listed
Affected: cvstrac/cvstrac
Source: cve@mitre.org

References

http://lists.grok.org.uk/pipermail/full-disclosure/2007-January/052058.htmlPatch, Vendor Advisory
http://osvdb.org/31935
http://secunia.com/advisories/23940
http://securityreason.com/securityalert/2192
http://www.cvstrac.org/cvstrac/chngview?cn=850Patch, Vendor Advisory
http://www.cvstrac.org/cvstrac/tktview?tn=683Patch, Vendor Advisory
http://www.openpkg.com/security/advisories/OpenPKG-SA-2007.008.htmlVendor Advisory
http://www.securityfocus.com/archive/1/458455/100/0/threaded
http://www.securityfocus.com/bid/22296
http://www.vupen.com/english/advisories/2007/0398
http://lists.grok.org.uk/pipermail/full-disclosure/2007-January/052058.htmlPatch, Vendor Advisory
http://osvdb.org/31935
http://secunia.com/advisories/23940
http://securityreason.com/securityalert/2192
http://www.cvstrac.org/cvstrac/chngview?cn=850Patch, Vendor Advisory
http://www.cvstrac.org/cvstrac/tktview?tn=683Patch, Vendor Advisory
http://www.openpkg.com/security/advisories/OpenPKG-SA-2007.008.htmlVendor Advisory
http://www.securityfocus.com/archive/1/458455/100/0/threaded
http://www.securityfocus.com/bid/22296
http://www.vupen.com/english/advisories/2007/0398

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.