CVE-2007-2482 - Directory traversal vulnerability in wordtube-button.php in the wordTube 1.43 and earlier plugin for

CVE-2007-2482

Summary

Directory traversal vulnerability in wordtube-button.php in the wordTube 1.43 and earlier plugin for WordPress, when register_globals is enabled, allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the wpPATH parameter.

References

Vulnerable Configurations

cpe:2.3:a:ruben_boelinger:wordtube:*:*:*:*:*:*:*:*
cpe:2.3:a:ruben_boelinger:wordtube:*:*:*:*:*:*:*:*

CVSS

Base:	6.8 (as of 16-10-2018 - 16:44)
Impact:
Exploitability:

CWE

NVD-CWE-Other

CAPEC

Access

Vector	Complexity	Authentication
NETWORK	MEDIUM	NONE

Impact

Confidentiality	Integrity	Availability
PARTIAL	PARTIAL	PARTIAL

cvss-vector via4

AV:N/AC:M/Au:N/C:P/I:P/A:P

refmap via4

bid	23737
bugtraq	20070502 [ECHO_ADV_81$2007] wordpress plugins wordTube <= 1.43 (wpPATH) Remote File Inclusion Vulnerability
confirm	http://alexrabe.boelinger.com/
exploit-db	3825
misc	http://advisories.echo.or.id/adv/adv81-K-159-2007.txt
osvdb	45168
secunia	25074
sreason	2660
vupen	ADV-2007-1615
xf	wordtube-wordtube-file-include(33996)

Last major update

16-10-2018 - 16:44

Published

03-05-2007 - 17:19

Last modified

16-10-2018 - 16:44