VulnerabilityModified
CVE-2007-0620
download.php in FD Script 1.3.2 and earlier allows remote attackers to read source of files under the web document root with certain extensions, including .php, via a relative pathname in the fname parameter, as demonstrated by downloading config.php.
MEDIUM 5.0EPSS 3.61%
Does this matter?
Lower severity and a low EPSS score (3.61%). Track it; it rarely justifies an emergency change on its own.
Description
download.php in FD Script 1.3.2 and earlier allows remote attackers to read source of files under the web document root with certain extensions, including .php, via a relative pathname in the fname parameter, as demonstrated by downloading config.php.
- CVSS 2.0
- 5.0 MEDIUMAV:N/AC:L/Au:N/C:P/I:N/A:N
- EPSS
- 3.61% probability · 89th percentile
- CISA KEV
- Not listed
- Affected
- vlad leont/fd script
- Source
- cve@mitre.org
References
- http://osvdb.org/33001
- http://secunia.com/advisories/23947Vendor Advisory
- http://securityreason.com/securityalert/2197
- http://www.securityfocus.com/archive/1/458231/100/0/threaded
- http://www.securityfocus.com/bid/22265Exploit
- http://www.vupen.com/english/advisories/2007/0383
- https://exchange.xforce.ibmcloud.com/vulnerabilities/31915
- http://osvdb.org/33001
- http://secunia.com/advisories/23947Vendor Advisory
- http://securityreason.com/securityalert/2197
- http://www.securityfocus.com/archive/1/458231/100/0/threaded
- http://www.securityfocus.com/bid/22265Exploit
- http://www.vupen.com/english/advisories/2007/0383
- https://exchange.xforce.ibmcloud.com/vulnerabilities/31915
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.