CVE-2007-3258 - calendar.php in Calendarix 0.7.20070307 allows remote attackers to obtain sensitive information via

CVE-2007-3258

Summary

calendar.php in Calendarix 0.7.20070307 allows remote attackers to obtain sensitive information via large values to the (1) year and (2) month parameters, which causes negative values to be passed to the mktime library call, and reveals the installation path in the error message.

References

Vulnerable Configurations

cpe:2.3:a:vincent_hor:calendarix:0.7.2007-03-07:*:*:*:*:*:*:*
cpe:2.3:a:vincent_hor:calendarix:0.7.2007-03-07:*:*:*:*:*:*:*

CVSS

Base:	5.0 (as of 29-07-2017 - 01:32)
Impact:
Exploitability:

CWE

NVD-CWE-Other

CAPEC

Access

Vector	Complexity	Authentication
NETWORK	LOW	NONE

Impact

Confidentiality	Integrity	Availability
PARTIAL	NONE	NONE

cvss-vector via4

AV:N/AC:L/Au:N/C:P/I:N/A:N

refmap via4

bugtraq	20070625 Calendarix version 0.7. 20070307 Multiple Path Disclosure
fulldisc	20070625 Calendarix version 0.7. 20070307 Multiple Path Disclosure
misc	http://www.netvigilance.com/advisory0035
osvdb	35371
xf	calendarix-calendar-path-disclosure(35047)

Last major update

29-07-2017 - 01:32

Published

27-06-2007 - 17:30

Last modified

29-07-2017 - 01:32