NVD

Id
53922  
Name
CVE-2007-1742  
Description
suexec in Apache HTTP Server (httpd) 2.2.3 uses a partial comparison for verifying whether the current directory is within the document root, which might allow local users to perform unauthorized operations on incorrect directories, as demonstrated using "html_backup" and "htmleditor" under an "html" directory. NOTE: the researcher, who is reliable, claims that the vendor disputes the issue because "the attacks described rely on an insecure server configuration" in which the user "has write access to the document root."  
Reject
 
CVSS Version
2  
CVSS Score
3.7  
Severity
Low  
CVSS Base Score
3.7  
CVSS Impact Subscore
6.4  
CVSS Exploit Subscore
1.9  
CVSS Vector
(AV:L/AC:H/Au:N/C:P/I:P/A:P)  
Pub Date
2017-01-07  
Published
2007-04-13  
Modified Date
2008-11-13  
Seq
2007-1742  

Actions

Related NVD References

Id NVD Id NVD No. Reference Actions
273406 53922 CVE-2007-1742 20070411 Apache HTTPD suEXEC Multiple Vulnerabilities  View
273407 53922 CVE-2007-1742 [apache-http-dev] 20070328 [Fwd: iDefense Final Notice [IDEF1445]]  View
273408 53922 CVE-2007-1742 [apache-http-dev] 20070328 Re: [Fwd: iDefense Final Notice [IDEF1445]]  View
273409 53922 CVE-2007-1742 1017904  View

Related JVN

Id Name Title Summary Cveinfo Name Cveinfo Id Nvdinfo Name Nvdinfo Id Cvssv2 Cvssv3 Jvnurl Published Date Last Updated Date Actions
53066 JVNDB-2007-001758 Apache HTTP Server (httpd) の suexec における承認されていない操作を間違ったディレクトリで実行される脆弱性 Apache HTTP Server (httpd) の suexec は、カレントディレクトリがドキュメントルート内にあるかどうかを確認するために部分比較を使用するため、承認されていない操作を間違ったディレクトリで実行される脆弱性が存在します。 CVE-2007-1742 25097 CVE-2007-1742 53922 3.7 http://jvndb.jvn.jp/ja/contents/2007/JVNDB-2007-001758.html 2007-04-13 2012-06-26 View