« Volver al listado

CVE-2007-3058

Estado: ModificadaMedia (6.8)—

Multiple PHP remote file inclusion vulnerabilities in Madirish Webmail 2.0 allow remote attackers to execute arbitrary PHP code via a URL in the GLOBALS[basedir] parameter to (1) calendar.php, (2) compose.php, and (3) index.php, different vectors than CVE-2007-2826. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

Madirish Webmail — Madirish Webmail

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2007-3058",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 6.8,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P",
          "authentication": "NONE",
          "integrityImpact": "PARTIAL",
          "accessComplexity": "MEDIUM",
          "availabilityImpact": "PARTIAL",
          "confidentialityImpact": "PARTIAL"
        },
        "acInsufInfo": false,
        "impactScore": 6.4,
        "baseSeverity": "MEDIUM",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 8.6,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": true,
        "userInteractionRequired": false
      }
    ]
  },
  "affected": [
    {
      "source": "cve@mitre.org",
      "affectedData": [
        {
          "vendor": "n/a",
          "product": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ]
    }
  ],
  "published": "2007-06-06T01:30:00.000",
  "references": [
    {
      "url": "http://osvdb.org/36803",
      "source": "cve@mitre.org"
    },
    {
      "url": "http://osvdb.org/36804",
      "source": "cve@mitre.org"
    },
    {
      "url": "http://osvdb.org/36805",
      "source": "cve@mitre.org"
    },
    {
      "url": "http://secunia.com/advisories/25475",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "cve@mitre.org"
    },
    {
      "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/34667",
      "source": "cve@mitre.org"
    },
    {
      "url": "http://osvdb.org/36803",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://osvdb.org/36804",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://osvdb.org/36805",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://secunia.com/advisories/25475",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/34667",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "NVD-CWE-Other"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Multiple PHP remote file inclusion vulnerabilities in Madirish Webmail 2.0 allow remote attackers to execute arbitrary PHP code via a URL in the GLOBALS[basedir] parameter to (1) calendar.php, (2) compose.php, and (3) index.php, different vectors than CVE-2007-2826.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information."
    },
    {
      "lang": "es",
      "value": "Múltiples vulnerabilidades de inclusión remota de archivo en PHP en Madirish Webmail 2.0 permite a atacantes remotos ejecutar código PHP de su elección mediante un URL en el parámetro GLOBALS[basedir] de (1) calendar.php, (2) compose.php, y (3) index.php, vectores diferentes de CVE-2007-2826. NOTA: la procedencia de esta información es desconocida; los detalles se han obtenido exclusivamente de información de terceros."
    }
  ],
  "lastModified": "2026-06-16T22:40:57.890",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:madirish_webmail:madirish_webmail:2.0:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "9A6B0173-F8B6-477C-BBE0-9696FEF2A602"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "cve@mitre.org",
  "evaluatorSolution": "A solution/patch has been released for these vulnerabilities: \r\n \r\n CVE-2007-2826\r\n CVE-2007-3058 \r\n\r\nhttps://sourceforge.net/projects/madirishwebmail/\r\n\r\nhttps://sourceforge.net/project/shownotes.phpgroup_id=101727&release_id=517013\r\n"
}