Unscored severity · published Jan 26, 2007
CVE-2007-0505
Unrestricted file upload vulnerability in the Project issue tracking 4.7.0 through 5.x before 20070123, a module for Drupal, allows remote authenticated users to execute arbitrary…
–
CVSS
2.9%
EPSS
No
On KEV
Description
Unrestricted file upload vulnerability in the Project issue tracking 4.7.0 through 5.x before 20070123, a module for Drupal, allows remote authenticated users to execute arbitrary code by attaching a file with executable or multiple extensions to a project issue.
Exploitation
Is it being used?
Exploit prediction (EPSS)2.9% · higher than 87% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
PR
Project · Drupal
4.6; 4.6_1.1; 4.7; 4.7_1.1; 4.7_2.1; 5.0 · source: NVD
PI
Project Issue Tracking Module · Drupal
4.7; 4.7_1.1; 4.7_2.1; 5.0 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2007-0505
CVE.org
https://www.cve.org/CVERecord?id=CVE-2007-0505
Patch
http://drupal.org/node/112146
osvdb.org
http://osvdb.org/32134
secunia.com
http://secunia.com/advisories/23887
www.securityfocus.com
http://www.securityfocus.com/bid/22224
www.vupen.com
http://www.vupen.com/english/advisories/2007/0312
exchange.xforce.ibmcloud.com
https://exchange.xforce.ibmcloud.com/vulnerabilities/31729
More from Project
–
CVE-2007-4436
The Drupal Project module before 5.x-1.0, 4.7.x-2.3, and 4.7.x-1.3 and Project issue tracking module before 5.x-1.0, 4.7.x-2.4, and 4.7.x-1.4 do not properly enforce permissions,…
–
CVE-2007-0534
Multiple cross-site scripting (XSS) vulnerabilities in the (1) Project issue tracking 4.7.0 through 5.x before 20070123 and (2) Project 4.6.0 through 5.x before 20070123 modules…
–
CVE-2007-0506
The project_issue_access function in the Project issue tracking 4.7.0 through 5.x before 20070123 module for Drupal allows remote authenticated users to bypass other access…