CVE-2007-3621

Multiple CRLF injection vulnerabilities in callboth.php in AsteriDex 3.0 and earlier allow remote attackers to inject arbitrary shell commands via the (1) IN and (2) OUT parameters.

CVSS v2.0 7.5 HIGH

7.5^/10

CVSS v2.0 : HIGH

Vector : AV:N/AC:L/Au:N/C:P/I:P/A:P

Exploitability : 10.0 / Impact : 6.4

Access Vector NETWORK

Access Complexity LOW

Authentication NONE

Confidentiality Impact PARTIAL

Integrity Impact PARTIAL

Availability Impact PARTIAL

References

Link	Resource
http://www.hoku.co.uk/advisories/asteridex.txt
http://www.securityfocus.com/bid/24781	Exploit Patch
http://secunia.com/advisories/25965	Vendor Advisory
http://bestof.nerdvittles.com/applications/asteridex/
http://securityreason.com/securityalert/2863
http://www.vupen.com/english/advisories/2007/2446
http://osvdb.org/37846
https://exchange.xforce.ibmcloud.com/vulnerabilities/35270
https://www.exploit-db.com/exploits/4151
http://www.securityfocus.com/archive/1/472907/100/0/threaded

Advertisement

Configurations

Configuration 1 (hide)

cpe:2.3:a:asteridex:asteridex:*:*:*:*:*:*:*:*

Information

Published : 2007-07-09 09:30

Updated : 2018-10-15 14:29

NVD link : CVE-2007-3621

Mitre link : CVE-2007-3621

JSON object : View

CWE

NVD-CWE-Other

Advertisement

Products Affected

asteridex

asteridex

{"cve": {"data_type": "CVE", "references": {"reference_data": [{"url": "http://www.hoku.co.uk/advisories/asteridex.txt", "name": "http://www.hoku.co.uk/advisories/asteridex.txt", "tags": [], "refsource": "MISC"}, {"url": "http://www.securityfocus.com/bid/24781", "name": "24781", "tags": ["Exploit", "Patch"], "refsource": "BID"}, {"url": "http://secunia.com/advisories/25965", "name": "25965", "tags": ["Vendor Advisory"], "refsource": "SECUNIA"}, {"url": "http://bestof.nerdvittles.com/applications/asteridex/", "name": "http://bestof.nerdvittles.com/applications/asteridex/", "tags": [], "refsource": "CONFIRM"}, {"url": "http://securityreason.com/securityalert/2863", "name": "2863", "tags": [], "refsource": "SREASON"}, {"url": "http://www.vupen.com/english/advisories/2007/2446", "name": "ADV-2007-2446", "tags": [], "refsource": "VUPEN"}, {"url": "http://osvdb.org/37846", "name": "37846", "tags": [], "refsource": "OSVDB"}, {"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/35270", "name": "asteridex-callboth-command-execution(35270)", "tags": [], "refsource": "XF"}, {"url": "https://www.exploit-db.com/exploits/4151", "name": "4151", "tags": [], "refsource": "EXPLOIT-DB"}, {"url": "http://www.securityfocus.com/archive/1/472907/100/0/threaded", "name": "20070705 AsteriDex (Asterisk / Trixbox) remote code execution", "tags": [], "refsource": "BUGTRAQ"}]}, "data_format": "MITRE", "description": {"description_data": [{"lang": "en", "value": "Multiple CRLF injection vulnerabilities in callboth.php in AsteriDex 3.0 and earlier allow remote attackers to inject arbitrary shell commands via the (1) IN and (2) OUT parameters."}]}, "problemtype": {"problemtype_data": [{"description": [{"lang": "en", "value": "NVD-CWE-Other"}]}]}, "data_version": "4.0", "CVE_data_meta": {"ID": "CVE-2007-3621", "ASSIGNER": "cve@mitre.org"}}, "impact": {"baseMetricV2": {"cvssV2": {"version": "2.0", "baseScore": 7.5, "accessVector": "NETWORK", "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P", "authentication": "NONE", "integrityImpact": "PARTIAL", "accessComplexity": "LOW", "availabilityImpact": "PARTIAL", "confidentialityImpact": "PARTIAL"}, "severity": "HIGH", "impactScore": 6.4, "obtainAllPrivilege": false, "exploitabilityScore": 10.0, "obtainUserPrivilege": false, "obtainOtherPrivilege": true, "userInteractionRequired": false}}, "publishedDate": "2007-07-09T16:30Z", "configurations": {"nodes": [{"children": [], "operator": "OR", "cpe_match": [{"cpe23Uri": "cpe:2.3:a:asteridex:asteridex:*:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true, "versionEndIncluding": "3.0"}]}], "CVE_data_version": "4.0"}, "lastModifiedDate": "2018-10-15T21:29Z"}