« Volver al listado

CVE-2007-5034

Estado: ModificadaMedia (4.3)—

ELinks anterior a la versión 0.11.3, cuando envía una petición POST para un URL https, añade el cuerpo y cabeceras de contenido de la petición POST a la petición CONNECT en texto plano, lo que permite a atacantes remotos recoger (sniff) datos sensible que deberían de haberse protegido con TLS. NOTA: esta vulnerabilidad sólo ocurre cuando el proxy está definido por https.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

Elinks — Elinks

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2007-5034",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 4.3,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:M/Au:N/C:P/I:N/A:N",
          "authentication": "NONE",
          "integrityImpact": "NONE",
          "accessComplexity": "MEDIUM",
          "availabilityImpact": "NONE",
          "confidentialityImpact": "PARTIAL"
        },
        "acInsufInfo": false,
        "impactScore": 2.9,
        "baseSeverity": "MEDIUM",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 8.6,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": false
      }
    ]
  },
  "affected": [
    {
      "source": "security@ubuntu.com",
      "affectedData": [
        {
          "vendor": "n/a",
          "product": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ]
    }
  ],
  "published": "2007-09-21T20:17:00.000",
  "references": [
    {
      "url": "http://bugzilla.elinks.cz/show_bug.cgi?id=937",
      "source": "security@ubuntu.com"
    },
    {
      "url": "http://secunia.com/advisories/26936",
      "source": "security@ubuntu.com"
    },
    {
      "url": "http://secunia.com/advisories/26949",
      "source": "security@ubuntu.com"
    },
    {
      "url": "http://secunia.com/advisories/26956",
      "source": "security@ubuntu.com"
    },
    {
      "url": "http://secunia.com/advisories/27038",
      "source": "security@ubuntu.com"
    },
    {
      "url": "http://secunia.com/advisories/27062",
      "source": "security@ubuntu.com"
    },
    {
      "url": "http://secunia.com/advisories/27125",
      "source": "security@ubuntu.com"
    },
    {
      "url": "http://secunia.com/advisories/27132",
      "source": "security@ubuntu.com"
    },
    {
      "url": "http://www.debian.org/security/2007/dsa-1380",
      "source": "security@ubuntu.com"
    },
    {
      "url": "http://www.redhat.com/support/errata/RHSA-2007-0933.html",
      "source": "security@ubuntu.com"
    },
    {
      "url": "http://www.securityfocus.com/archive/1/481606/100/0/threaded",
      "source": "security@ubuntu.com"
    },
    {
      "url": "http://www.securityfocus.com/bid/25799",
      "source": "security@ubuntu.com"
    },
    {
      "url": "http://www.securitytracker.com/id?1018764",
      "source": "security@ubuntu.com"
    },
    {
      "url": "http://www.ubuntu.com/usn/usn-519-1",
      "source": "security@ubuntu.com"
    },
    {
      "url": "http://www.vupen.com/english/advisories/2007/3278",
      "source": "security@ubuntu.com"
    },
    {
      "url": "https://bugs.launchpad.net/ubuntu/+source/elinks/+bug/141018",
      "source": "security@ubuntu.com"
    },
    {
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=297981",
      "source": "security@ubuntu.com"
    },
    {
      "url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10335",
      "source": "security@ubuntu.com"
    },
    {
      "url": "https://www.redhat.com/archives/fedora-package-announce/2007-October/msg00079.html",
      "source": "security@ubuntu.com"
    },
    {
      "url": "https://www.redhat.com/archives/fedora-package-announce/2007-September/msg00335.html",
      "source": "security@ubuntu.com"
    },
    {
      "url": "http://bugzilla.elinks.cz/show_bug.cgi?id=937",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://secunia.com/advisories/26936",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://secunia.com/advisories/26949",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://secunia.com/advisories/26956",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://secunia.com/advisories/27038",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://secunia.com/advisories/27062",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://secunia.com/advisories/27125",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://secunia.com/advisories/27132",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.debian.org/security/2007/dsa-1380",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.redhat.com/support/errata/RHSA-2007-0933.html",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.securityfocus.com/archive/1/481606/100/0/threaded",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.securityfocus.com/bid/25799",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.securitytracker.com/id?1018764",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.ubuntu.com/usn/usn-519-1",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.vupen.com/english/advisories/2007/3278",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://bugs.launchpad.net/ubuntu/+source/elinks/+bug/141018",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=297981",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10335",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://www.redhat.com/archives/fedora-package-announce/2007-October/msg00079.html",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://www.redhat.com/archives/fedora-package-announce/2007-September/msg00335.html",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-200"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "ELinks before 0.11.3, when sending a POST request for an https URL, appends the body and content headers of the POST request to the CONNECT request in cleartext, which allows remote attackers to sniff sensitive data that would have been protected by TLS.  NOTE: this issue only occurs when a proxy is defined for https."
    },
    {
      "lang": "es",
      "value": "ELinks anterior a la versión 0.11.3, cuando envía una petición POST para un URL https, añade el cuerpo y cabeceras de contenido de la petición POST a la petición CONNECT en texto plano, lo que permite a atacantes remotos recoger (sniff) datos sensible que deberían de haberse protegido con TLS. NOTA: esta vulnerabilidad sólo ocurre cuando el proxy está definido por https."
    }
  ],
  "lastModified": "2026-06-16T22:45:19.560",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:elinks:elinks:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "FC9B3D24-93B5-4E3B-868E-B25CB51790C1",
              "versionEndIncluding": "0.11.1"
            },
            {
              "criteria": "cpe:2.3:a:elinks:elinks:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "33F2AF11-B4BA-4954-BEFE-1482F2A104CC",
              "versionEndIncluding": "0.11.2"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "security@ubuntu.com"
}