« Volver al listado

CVE-2007-4230

Estado: ModificadaAlta (7.5)—

** IMPUGNADO ** BellaBiblio permite a atacantes remotos obtener privilegios administrativos mediante una cookie bellabiblio con el valor "administrator". NOTA: este asunto se impugna por el CVE y múltiples terceras partes porque el valor de cookie debe ser un resumen MD5.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

Jems Scripts — Bellabiblio

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2007-4230",
  "cveTags": [
    {
      "tags": [
        "disputed"
      ],
      "sourceIdentifier": "cve@mitre.org"
    }
  ],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 7.5,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P",
          "authentication": "NONE",
          "integrityImpact": "PARTIAL",
          "accessComplexity": "LOW",
          "availabilityImpact": "PARTIAL",
          "confidentialityImpact": "PARTIAL"
        },
        "acInsufInfo": false,
        "impactScore": 6.4,
        "baseSeverity": "HIGH",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 10,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": true,
        "userInteractionRequired": false
      }
    ]
  },
  "affected": [
    {
      "source": "cve@mitre.org",
      "affectedData": [
        {
          "vendor": "n/a",
          "product": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ]
    }
  ],
  "published": "2007-08-08T22:17:00.000",
  "references": [
    {
      "url": "http://osvdb.org/39032",
      "source": "cve@mitre.org"
    },
    {
      "url": "http://securityreason.com/securityalert/2991",
      "source": "cve@mitre.org"
    },
    {
      "url": "http://www.attrition.org/pipermail/vim/2007-July/001733.html",
      "source": "cve@mitre.org"
    },
    {
      "url": "http://www.attrition.org/pipermail/vim/2007-July/001736.html",
      "source": "cve@mitre.org"
    },
    {
      "url": "http://www.attrition.org/pipermail/vim/2007-July/001745.html",
      "source": "cve@mitre.org"
    },
    {
      "url": "http://www.securityfocus.com/archive/1/475103/100/0/threaded",
      "source": "cve@mitre.org"
    },
    {
      "url": "http://www.securityfocus.com/bid/25140",
      "source": "cve@mitre.org"
    },
    {
      "url": "http://osvdb.org/39032",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://securityreason.com/securityalert/2991",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.attrition.org/pipermail/vim/2007-July/001733.html",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.attrition.org/pipermail/vim/2007-July/001736.html",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.attrition.org/pipermail/vim/2007-July/001745.html",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.securityfocus.com/archive/1/475103/100/0/threaded",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.securityfocus.com/bid/25140",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "NVD-CWE-Other"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "BellaBiblio allows remote attackers to gain administrative privileges via a bellabiblio cookie with the value \"administrator.\" NOTE: this issue is disputed by CVE and multiple third parties because the cookie value must be an MD5 hash"
    },
    {
      "lang": "es",
      "value": "** IMPUGNADO ** BellaBiblio permite a atacantes remotos obtener privilegios administrativos mediante una cookie bellabiblio con el valor \"administrator\".\r\nNOTA: este asunto se impugna por el CVE y múltiples terceras partes porque el valor de cookie debe ser un resumen MD5."
    }
  ],
  "lastModified": "2026-06-16T22:43:38.520",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:jems_scripts:bellabiblio:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "CEF386C0-CA82-43F7-9DBC-6BD603B06376"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "cve@mitre.org"
}