VulnerabilityModified
CVE-2007-1364
DropAFew before 0.2.1 does not require authorization for certain privileged actions, which allows remote attackers to (1) view the logged calorie information of arbitrary users via the id parameter in editlogcal.php, (2) add arbitrary links via…
MEDIUM 6.4EPSS 2.25%
Does this matter?
Lower severity and a low EPSS score (2.25%). Track it; it rarely justifies an emergency change on its own.
Description
DropAFew before 0.2.1 does not require authorization for certain privileged actions, which allows remote attackers to (1) view the logged calorie information of arbitrary users via the id parameter in editlogcal.php, (2) add arbitrary links via links.php, or (3) create arbitrary users via newaccount2.php.
- CVSS 2.0
- 6.4 MEDIUMAV:N/AC:L/Au:N/C:P/I:P/A:N
- EPSS
- 2.25% probability · 82th percentile
- CISA KEV
- Not listed
- Affected
- dropafew/dropafew
- Source
- cve@mitre.org
References
- http://secunia.com/advisories/24861Vendor Advisory
- http://www.dropafew.com/sphpblog/comments.php?y=07&m=04&entry=entry070403-224437Patch
- http://www.securityfocus.com/bid/23400Exploit
- https://exchange.xforce.ibmcloud.com/vulnerabilities/33561
- https://www.cynops.de/advisories/CVE-2007-1363.txtVendor Advisory
- http://secunia.com/advisories/24861Vendor Advisory
- http://www.dropafew.com/sphpblog/comments.php?y=07&m=04&entry=entry070403-224437Patch
- http://www.securityfocus.com/bid/23400Exploit
- https://exchange.xforce.ibmcloud.com/vulnerabilities/33561
- https://www.cynops.de/advisories/CVE-2007-1363.txtVendor Advisory
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.