CVE-2007-2720

Published May 16, 2007

Last updated 14 years ago

Overview

Description: Group-Office before 2.16-13 does not properly validate user IDs, which allows remote attackers to obtain sensitive information via certain requests for (1) message.php and (2) messages.php in modules/email/. NOTE: some of these details are obtained from third party information.
Source: cve@mitre.org
NVD status: Modified

Risk scores

CVSS 2.0

Type: Primary
Base score: 4.3
Impact score: 2.9
Exploitability score: 8.6
Vector string: AV:N/AC:M/Au:N/C:P/I:N/A:N

Weaknesses

nvd@nist.gov: NVD-CWE-Other

Hype score: Not currently trending

Configurations

[
  {
    "nodes": [
      {
        "negate": false,
        "cpeMatch": [
          {
            "criteria": "cpe:2.3:a:group-office:group-office_groupware:2.16.12:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "DAE92AB7-A14F-4A93-9313-57EA0EAB8C48"
          }
        ],
        "operator": "OR"
      }
    ]
  }
]

References