var-200708-0345
Vulnerability from variot
Cross-site request forgery (CSRF) vulnerability in /xslt in 2wire 1701HG and 2071 Gateway routers, with 3.17.5 and 5.29.51 software, allows remote attackers to perform certain configuration changes as administrators. A remote attacker performs some setting changes like an administrator.
BETA test the new Secunia Personal Software Inspector!
The Secunia PSI detects installed software on your computer and categorises it as either Insecure, End-of-Life, or Up-To-Date. Effectively enabling you to focus your attention on software installations where more secure versions are available from the vendors. This can be exploited to perform certain actions on the device when a logged in administrator is tricked into visiting a malicious web page.
The vulnerability is reported in 1701HG version 3.17.5 and 2071 Gateway version 5.29.51. Other versions may also be affected.
SOLUTION: Do not browse untrusted web sites while being logged in to the administrative section of the device.
PROVIDED AND/OR DISCOVERED BY: hkm
ORIGINAL ADVISORY: http://archives.neohapsis.com/archives/bugtraq/2007-08/0226.html
About: This Advisory was delivered by Secunia as a free service to help everybody keeping their systems up to date against the latest vulnerabilities.
Subscribe: http://secunia.com/secunia_security_advisories/
Definitions: (Criticality, Where etc.) http://secunia.com/about_secunia_advisories/
Please Note: Secunia recommends that you verify all advisories you receive by clicking the link. Secunia NEVER sends attached files with advisories. Secunia does not advise people to install third party patches, only use those supplied by the vendor.
Unsubscribe: Secunia Security Advisories http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org
Show details on source website
{
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/VARIoTentry#",
"affected_products": {
"@id": "https://www.variotdbs.pl/ref/affected_products"
},
"configurations": {
"@id": "https://www.variotdbs.pl/ref/configurations"
},
"credits": {
"@id": "https://www.variotdbs.pl/ref/credits"
},
"cvss": {
"@id": "https://www.variotdbs.pl/ref/cvss/"
},
"description": {
"@id": "https://www.variotdbs.pl/ref/description/"
},
"exploit_availability": {
"@id": "https://www.variotdbs.pl/ref/exploit_availability/"
},
"external_ids": {
"@id": "https://www.variotdbs.pl/ref/external_ids/"
},
"iot": {
"@id": "https://www.variotdbs.pl/ref/iot/"
},
"iot_taxonomy": {
"@id": "https://www.variotdbs.pl/ref/iot_taxonomy/"
},
"patch": {
"@id": "https://www.variotdbs.pl/ref/patch/"
},
"problemtype_data": {
"@id": "https://www.variotdbs.pl/ref/problemtype_data/"
},
"references": {
"@id": "https://www.variotdbs.pl/ref/references/"
},
"sources": {
"@id": "https://www.variotdbs.pl/ref/sources/"
},
"sources_release_date": {
"@id": "https://www.variotdbs.pl/ref/sources_release_date/"
},
"sources_update_date": {
"@id": "https://www.variotdbs.pl/ref/sources_update_date/"
},
"threat_type": {
"@id": "https://www.variotdbs.pl/ref/threat_type/"
},
"title": {
"@id": "https://www.variotdbs.pl/ref/title/"
},
"type": {
"@id": "https://www.variotdbs.pl/ref/type/"
}
},
"@id": "https://www.variotdbs.pl/vuln/VAR-200708-0345",
"affected_products": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/affected_products#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"model": "1701hg router",
"scope": "eq",
"trust": 1.9,
"vendor": "2wire",
"version": "5.29.51"
},
{
"model": "1701hg router",
"scope": "eq",
"trust": 1.9,
"vendor": "2wire",
"version": "3.17.5"
},
{
"model": "2071 router",
"scope": "eq",
"trust": 1.6,
"vendor": "2wire",
"version": "5.29.51"
},
{
"model": "2071 router",
"scope": "eq",
"trust": 1.6,
"vendor": "2wire",
"version": "3.17.5"
},
{
"model": "1701hg router",
"scope": "eq",
"trust": 0.8,
"vendor": "2wire",
"version": "software 5.29.51 and 3.17.5"
},
{
"model": "2071 router",
"scope": "eq",
"trust": 0.8,
"vendor": "2wire",
"version": "software 5.29.51 and 3.17.5"
},
{
"model": "router",
"scope": "eq",
"trust": 0.3,
"vendor": "2wire",
"version": "20715.29.51"
},
{
"model": "router",
"scope": "eq",
"trust": 0.3,
"vendor": "2wire",
"version": "20713.17.5"
}
],
"sources": [
{
"db": "BID",
"id": "85448"
},
{
"db": "JVNDB",
"id": "JVNDB-2007-002515"
},
{
"db": "CNNVD",
"id": "CNNVD-200708-277"
},
{
"db": "NVD",
"id": "CVE-2007-4387"
}
]
},
"configurations": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/configurations#",
"children": {
"@container": "@list"
},
"cpe_match": {
"@container": "@list"
},
"data": {
"@container": "@list"
},
"nodes": {
"@container": "@list"
}
},
"data": [
{
"CVE_data_version": "4.0",
"nodes": [
{
"cpe_match": [
{
"cpe22Uri": "cpe:/h:2wire:1701hg_router",
"vulnerable": true
},
{
"cpe22Uri": "cpe:/h:2wire:2071_router",
"vulnerable": true
}
],
"operator": "OR"
}
]
}
],
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2007-002515"
}
]
},
"credits": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/credits#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Unknown",
"sources": [
{
"db": "BID",
"id": "85448"
}
],
"trust": 0.3
},
"cve": "CVE-2007-4387",
"cvss": {
"@context": {
"cvssV2": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV2#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV2"
},
"cvssV3": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV3#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV3/"
},
"severity": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/cvss/severity#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/severity"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"cvssV2": [
{
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "nvd@nist.gov",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"confidentialityImpact": "NONE",
"exploitabilityScore": 8.6,
"id": "CVE-2007-4387",
"impactScore": 2.9,
"integrityImpact": "PARTIAL",
"severity": "MEDIUM",
"trust": 1.8,
"vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N",
"version": "2.0"
},
{
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "VULHUB",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"confidentialityImpact": "NONE",
"exploitabilityScore": 8.6,
"id": "VHN-27749",
"impactScore": 2.9,
"integrityImpact": "PARTIAL",
"severity": "MEDIUM",
"trust": 0.1,
"vectorString": "AV:N/AC:M/AU:N/C:N/I:P/A:N",
"version": "2.0"
}
],
"cvssV3": [],
"severity": [
{
"author": "nvd@nist.gov",
"id": "CVE-2007-4387",
"trust": 1.0,
"value": "MEDIUM"
},
{
"author": "NVD",
"id": "CVE-2007-4387",
"trust": 0.8,
"value": "Medium"
},
{
"author": "CNNVD",
"id": "CNNVD-200708-277",
"trust": 0.6,
"value": "MEDIUM"
},
{
"author": "VULHUB",
"id": "VHN-27749",
"trust": 0.1,
"value": "MEDIUM"
}
]
}
],
"sources": [
{
"db": "VULHUB",
"id": "VHN-27749"
},
{
"db": "JVNDB",
"id": "JVNDB-2007-002515"
},
{
"db": "CNNVD",
"id": "CNNVD-200708-277"
},
{
"db": "NVD",
"id": "CVE-2007-4387"
}
]
},
"description": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/description#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Cross-site request forgery (CSRF) vulnerability in /xslt in 2wire 1701HG and 2071 Gateway routers, with 3.17.5 and 5.29.51 software, allows remote attackers to perform certain configuration changes as administrators. A remote attacker performs some setting changes like an administrator. \n\n----------------------------------------------------------------------\n\nBETA test the new Secunia Personal Software Inspector!\n\nThe Secunia PSI detects installed software on your computer and\ncategorises it as either Insecure, End-of-Life, or Up-To-Date. \nEffectively enabling you to focus your attention on software\ninstallations where more secure versions are available from the\nvendors. This can be\nexploited to perform certain actions on the device when a logged in\nadministrator is tricked into visiting a malicious web page. \n\nThe vulnerability is reported in 1701HG version 3.17.5 and 2071\nGateway version 5.29.51. Other versions may also be affected. \n\nSOLUTION:\nDo not browse untrusted web sites while being logged in to the\nadministrative section of the device. \n\nPROVIDED AND/OR DISCOVERED BY:\nhkm\n\nORIGINAL ADVISORY:\nhttp://archives.neohapsis.com/archives/bugtraq/2007-08/0226.html\n\n----------------------------------------------------------------------\n\nAbout:\nThis Advisory was delivered by Secunia as a free service to help\neverybody keeping their systems up to date against the latest\nvulnerabilities. \n\nSubscribe:\nhttp://secunia.com/secunia_security_advisories/\n\nDefinitions: (Criticality, Where etc.)\nhttp://secunia.com/about_secunia_advisories/\n\n\nPlease Note:\nSecunia recommends that you verify all advisories you receive by\nclicking the link. \nSecunia NEVER sends attached files with advisories. \nSecunia does not advise people to install third party patches, only\nuse those supplied by the vendor. \n\n----------------------------------------------------------------------\n\nUnsubscribe: Secunia Security Advisories\nhttp://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org\n\n----------------------------------------------------------------------\n\n\n",
"sources": [
{
"db": "NVD",
"id": "CVE-2007-4387"
},
{
"db": "JVNDB",
"id": "JVNDB-2007-002515"
},
{
"db": "BID",
"id": "85448"
},
{
"db": "VULHUB",
"id": "VHN-27749"
},
{
"db": "PACKETSTORM",
"id": "58730"
}
],
"trust": 2.07
},
"external_ids": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/external_ids#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"db": "NVD",
"id": "CVE-2007-4387",
"trust": 2.8
},
{
"db": "SREASON",
"id": "3026",
"trust": 2.0
},
{
"db": "SECUNIA",
"id": "26496",
"trust": 1.8
},
{
"db": "OSVDB",
"id": "37667",
"trust": 1.7
},
{
"db": "XF",
"id": "36044",
"trust": 0.9
},
{
"db": "JVNDB",
"id": "JVNDB-2007-002515",
"trust": 0.8
},
{
"db": "XF",
"id": "2",
"trust": 0.6
},
{
"db": "BUGTRAQ",
"id": "20070815 CROSS SITE REQUEST FORGERY IN 2WIRE ROUTERS",
"trust": 0.6
},
{
"db": "CNNVD",
"id": "CNNVD-200708-277",
"trust": 0.6
},
{
"db": "BID",
"id": "85448",
"trust": 0.4
},
{
"db": "VULHUB",
"id": "VHN-27749",
"trust": 0.1
},
{
"db": "PACKETSTORM",
"id": "58730",
"trust": 0.1
}
],
"sources": [
{
"db": "VULHUB",
"id": "VHN-27749"
},
{
"db": "BID",
"id": "85448"
},
{
"db": "JVNDB",
"id": "JVNDB-2007-002515"
},
{
"db": "PACKETSTORM",
"id": "58730"
},
{
"db": "CNNVD",
"id": "CNNVD-200708-277"
},
{
"db": "NVD",
"id": "CVE-2007-4387"
}
]
},
"id": "VAR-200708-0345",
"iot": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/iot#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": true,
"sources": [
{
"db": "VULHUB",
"id": "VHN-27749"
}
],
"trust": 0.01
},
"last_update_date": "2024-11-23T20:53:31.314000Z",
"patch": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/patch#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"title": "Top Page",
"trust": 0.8,
"url": "http://www.2wire.com/"
}
],
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2007-002515"
}
]
},
"problemtype_data": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/problemtype_data#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"problemtype": "NVD-CWE-Other",
"trust": 1.0
}
],
"sources": [
{
"db": "NVD",
"id": "CVE-2007-4387"
}
]
},
"references": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/references#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"trust": 2.0,
"url": "http://securityreason.com/securityalert/3026"
},
{
"trust": 1.7,
"url": "http://osvdb.org/37667"
},
{
"trust": 1.7,
"url": "http://secunia.com/advisories/26496"
},
{
"trust": 1.1,
"url": "http://www.securityfocus.com/archive/1/476595/100/0/threaded"
},
{
"trust": 1.1,
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/36044"
},
{
"trust": 0.9,
"url": "http://www.securityfocus.com/archive/1/archive/1/476595/100/0/threaded"
},
{
"trust": 0.9,
"url": "http://xforce.iss.net/xforce/xfdb/36044"
},
{
"trust": 0.8,
"url": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2007-4387"
},
{
"trust": 0.8,
"url": "http://web.nvd.nist.gov/view/vuln/detail?vulnid=cve-2007-4387"
},
{
"trust": 0.1,
"url": "http://secunia.com/secunia_security_advisories/"
},
{
"trust": 0.1,
"url": "http://secunia.com/product/2862/"
},
{
"trust": 0.1,
"url": "http://secunia.com/advisories/26496/"
},
{
"trust": 0.1,
"url": "https://psi.secunia.com/"
},
{
"trust": 0.1,
"url": "http://secunia.com/product/11696/"
},
{
"trust": 0.1,
"url": "http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org"
},
{
"trust": 0.1,
"url": "http://archives.neohapsis.com/archives/bugtraq/2007-08/0226.html"
},
{
"trust": 0.1,
"url": "http://secunia.com/about_secunia_advisories/"
}
],
"sources": [
{
"db": "VULHUB",
"id": "VHN-27749"
},
{
"db": "BID",
"id": "85448"
},
{
"db": "JVNDB",
"id": "JVNDB-2007-002515"
},
{
"db": "PACKETSTORM",
"id": "58730"
},
{
"db": "CNNVD",
"id": "CNNVD-200708-277"
},
{
"db": "NVD",
"id": "CVE-2007-4387"
}
]
},
"sources": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#",
"data": {
"@container": "@list"
}
},
"data": [
{
"db": "VULHUB",
"id": "VHN-27749"
},
{
"db": "BID",
"id": "85448"
},
{
"db": "JVNDB",
"id": "JVNDB-2007-002515"
},
{
"db": "PACKETSTORM",
"id": "58730"
},
{
"db": "CNNVD",
"id": "CNNVD-200708-277"
},
{
"db": "NVD",
"id": "CVE-2007-4387"
}
]
},
"sources_release_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_release_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2007-08-17T00:00:00",
"db": "VULHUB",
"id": "VHN-27749"
},
{
"date": "2007-08-17T00:00:00",
"db": "BID",
"id": "85448"
},
{
"date": "2012-06-26T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2007-002515"
},
{
"date": "2007-08-21T20:07:00",
"db": "PACKETSTORM",
"id": "58730"
},
{
"date": "2007-08-17T00:00:00",
"db": "CNNVD",
"id": "CNNVD-200708-277"
},
{
"date": "2007-08-17T22:17:00",
"db": "NVD",
"id": "CVE-2007-4387"
}
]
},
"sources_update_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_update_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2018-10-15T00:00:00",
"db": "VULHUB",
"id": "VHN-27749"
},
{
"date": "2007-08-17T00:00:00",
"db": "BID",
"id": "85448"
},
{
"date": "2012-06-26T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2007-002515"
},
{
"date": "2007-08-20T00:00:00",
"db": "CNNVD",
"id": "CNNVD-200708-277"
},
{
"date": "2024-11-21T00:35:28.220000",
"db": "NVD",
"id": "CVE-2007-4387"
}
]
},
"threat_type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/threat_type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "remote",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-200708-277"
}
],
"trust": 0.6
},
"title": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/title#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "2wire 1701HG and 2071 Gateway of /xslt Vulnerable to cross-site request forgery",
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2007-002515"
}
],
"trust": 0.8
},
"type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "unknown",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-200708-277"
}
],
"trust": 0.6
}
}
Loading…
Loading…
Sightings
| Author | Source | Type | Date |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
- Confirmed: The vulnerability is confirmed from an analyst perspective.
- Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
- Patched: This vulnerability was successfully patched by the user reporting the sighting.
- Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
- Not confirmed: The user expresses doubt about the veracity of the vulnerability.
- Not patched: This vulnerability was not successfully patched by the user reporting the sighting.
Loading…