1. CVE-Search
  2. CVE-2007-1035
ID CVE-2007-1035
Summary Unspecified vulnerability in certain demonstration scripts in getID3 1.7.1, as used in the Mediafield and Audio modules for Drupal, allows remote attackers to read and delete arbitrary files, list arbitrary directories, and write to empty files or .mp3 files via unknown vectors. This vulnerability affects the following versions of Drupal Mediafield Module: Drupal, Mediafield Module, 4.7.x-1.x-dev Drupal, Mediafield Module, 5.x-1.x-dev This vulnerability affects the following versions of Drupal Audio Module: Drupal, Audio Module, 4.7.x-1.x-dev Drupal, Audio Module, 5.x-0.2 Drupal, Audio Module, 5.x-0.x-dev
References
Vulnerable Configurations
  • cpe:2.3:a:drupal:audio_module:*:*:*:*:*:*:*:*
    cpe:2.3:a:drupal:audio_module:*:*:*:*:*:*:*:*
  • cpe:2.3:a:drupal:getid3:1.7.1:*:*:*:*:*:*:*
    cpe:2.3:a:drupal:getid3:1.7.1:*:*:*:*:*:*:*
  • cpe:2.3:a:drupal:mediafield_module:*:*:*:*:*:*:*:*
    cpe:2.3:a:drupal:mediafield_module:*:*:*:*:*:*:*:*
CVSS
Base: 7.5 (as of 29-07-2017 - 01:30)
Impact:
Exploitability:
CWE NVD-CWE-Other
CAPEC
Access
VectorComplexityAuthentication
NETWORK LOW NONE
Impact
ConfidentialityIntegrityAvailability
PARTIAL PARTIAL PARTIAL
cvss-vector via4 AV:N/AC:L/Au:N/C:P/I:P/A:P
refmap via4
bid 22587
confirm http://drupal.org/node/119385
misc http://blamcast.net/articles/highly-critical-security-flaws-in-drupal-audio-module
osvdb 35161
vupen ADV-2007-0635
xf drupal-getid3-code-execution(32542)
Last major update 29-07-2017 - 01:30
Published 21-02-2007 - 11:28
Last modified 29-07-2017 - 01:30
Back to Top