« Volver al listado

CVE-2007-0892

Estado: ModificadaAlta (7.5)—

CRLF injection vulnerability in phpMyVisites before 2.2 allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via CRLF sequences in the url parameter, when the pagename parameter begins with "FILE:".

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

Matthieu Aubry — Phpmyvisites

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2007-0892",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 7.5,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P",
          "authentication": "NONE",
          "integrityImpact": "PARTIAL",
          "accessComplexity": "LOW",
          "availabilityImpact": "PARTIAL",
          "confidentialityImpact": "PARTIAL"
        },
        "acInsufInfo": false,
        "impactScore": 6.4,
        "baseSeverity": "HIGH",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 10,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": false
      }
    ]
  },
  "affected": [
    {
      "source": "cve@mitre.org",
      "affectedData": [
        {
          "vendor": "n/a",
          "product": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ]
    }
  ],
  "published": "2007-02-12T23:28:00.000",
  "references": [
    {
      "url": "http://marc.info/?l=full-disclosure&m=117121596803908&w=2",
      "tags": [
        "Third Party Advisory"
      ],
      "source": "cve@mitre.org"
    },
    {
      "url": "http://osvdb.org/33177",
      "tags": [
        "Broken Link"
      ],
      "source": "cve@mitre.org"
    },
    {
      "url": "http://www.securityfocus.com/archive/1/459792/100/0/threaded",
      "source": "cve@mitre.org"
    },
    {
      "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/32428",
      "source": "cve@mitre.org"
    },
    {
      "url": "http://marc.info/?l=full-disclosure&m=117121596803908&w=2",
      "tags": [
        "Third Party Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://osvdb.org/33177",
      "tags": [
        "Broken Link"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.securityfocus.com/archive/1/459792/100/0/threaded",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/32428",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-93"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "CRLF injection vulnerability in phpMyVisites before 2.2 allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via CRLF sequences in the url parameter, when the pagename parameter begins with \"FILE:\"."
    },
    {
      "lang": "es",
      "value": "Vulnerabilidad de inyección CRLF en phpMyVisites anterior a 2.2 permite a atacantes remotos inyectar cabeceras HTTP de su elección y conducir respuestas HTTP dividiendo ataques a través de secuencias CRLF en el parámetro url, cuando el parámetro pagename comienza con \"FILE:\"."
    }
  ],
  "lastModified": "2026-06-16T22:36:29.623",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:matthieu_aubry:phpmyvisites:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "1F3EA8EE-BB15-477E-8264-F0A7A08C57A7",
              "versionEndIncluding": "2.1"
            },
            {
              "criteria": "cpe:2.3:a:matthieu_aubry:phpmyvisites:0.1_beta:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "4B94A2BE-746A-4306-A255-AA7687D63433"
            },
            {
              "criteria": "cpe:2.3:a:matthieu_aubry:phpmyvisites:1.0:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "E10F69FD-5578-4D84-98D5-30C2FF951A57"
            },
            {
              "criteria": "cpe:2.3:a:matthieu_aubry:phpmyvisites:1.1:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "94EE3865-3F82-4607-B73F-3FC8EFCB4DD1"
            },
            {
              "criteria": "cpe:2.3:a:matthieu_aubry:phpmyvisites:1.2:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "5EBB328F-120A-4C98-94A7-4643BE7C23DE"
            },
            {
              "criteria": "cpe:2.3:a:matthieu_aubry:phpmyvisites:1.2.1:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "183D3FFD-A4CB-42C8-978E-1608387CECD4"
            },
            {
              "criteria": "cpe:2.3:a:matthieu_aubry:phpmyvisites:1.2.2:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "74EB894E-25B8-4E74-83DF-741B27D739A7"
            },
            {
              "criteria": "cpe:2.3:a:matthieu_aubry:phpmyvisites:1.2_beta:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "4753A788-14D5-438D-AB16-E1DA0E6A1934"
            },
            {
              "criteria": "cpe:2.3:a:matthieu_aubry:phpmyvisites:1.3:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "FA73BFE8-81FF-4D4F-B290-05FBE6CF9BFA"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "cve@mitre.org"
}