CVE-2007-3816 - JWIG might allow context-dependent attackers to cause a denial of service (service degradation) via

CVE-2007-3816

Summary

JWIG might allow context-dependent attackers to cause a denial of service (service degradation) via loops of references to external templates. NOTE: this issue has been disputed by multiple third parties who state that only the application developer can trigger the issue, so no privilege boundaries are crossed. However, it seems possible that this is a vulnerability class to which an JWIG application may be vulnerable if template contents can be influenced, but this would be an issue in the application itself, not JWIG

References

Vulnerable Configurations

cpe:2.3:a:brics:jwig:*:*:*:*:*:*:*:*
cpe:2.3:a:brics:jwig:*:*:*:*:*:*:*:*

CVSS

Base:	7.8 (as of 17-05-2024 - 00:34)
Impact:
Exploitability:

CWE

NVD-CWE-Other

CAPEC

Access

Vector	Complexity	Authentication
NETWORK	LOW	NONE

Impact

Confidentiality	Integrity	Availability
NONE	NONE	COMPLETE

cvss-vector via4

AV:N/AC:L/Au:N/C:N/I:N/A:C

refmap via4

bid	24974
bugtraq	20070716 WhitePapers By SecNiche Security 20070721 Re: [WEB SECURITY] [CVE-2007-3816][Advisory] JWIG Context-Dependent Template Calling Dos 20070721 [CVE-2007-3816][Advisory] JWIG Context-Dependent Template Calling Dos
fulldisc	20070721 [CVE-2007-3816][Advisory] JWIG Context-Dependent Template Calling Dos 20070722 Re: [CVE 2007-3816] [Advisory] Vulnerability Facts Related JWIG Advisory 20070723 [CVE 2007-3816] [Advisory] Vulnerability Facts Related JWIG Advisory 20070726 [CVE 2007-3816] [Advisory] Vulnerability Facts Related JWIG Advisory
misc	http://www.secniche.org/papers/HackAnnotationsInJWIG.pdf
sectrack	1018432
xf	jwig-externaltemplate-dos(35515)

Last major update

17-05-2024 - 00:34

Published

17-07-2007 - 00:30

Last modified

17-05-2024 - 00:34