CVE-2007-1364

Published Apr 11, 2007

Last updated 8 years ago

Overview

Description: DropAFew before 0.2.1 does not require authorization for certain privileged actions, which allows remote attackers to (1) view the logged calorie information of arbitrary users via the id parameter in editlogcal.php, (2) add arbitrary links via links.php, or (3) create arbitrary users via newaccount2.php.
Source: cve@mitre.org
NVD status: Modified

Risk scores

CVSS 2.0

Type: Primary
Base score: 6.4
Impact score: 4.9
Exploitability score: 10
Vector string: AV:N/AC:L/Au:N/C:P/I:P/A:N

Weaknesses

nvd@nist.gov: NVD-CWE-Other

Hype score: Not currently trending

Configurations

[
  {
    "nodes": [
      {
        "negate": false,
        "cpeMatch": [
          {
            "criteria": "cpe:2.3:a:dropafew:dropafew:*:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "64C4B696-C5AF-4C47-91BB-B6EE202D6D89",
            "versionEndIncluding": "0.2"
          }
        ],
        "operator": "OR"
      }
    ]
  }
]

References