« Volver al listado

CVE-2007-4600

Estado: ModificadaMedia (4.6)—

The "Protect Worksheet" functionality in Mathsoft Mathcad 12 through 13.1, and PTC Mathcad 14, implements file access restrictions via a protection element in a gzipped XML file, which allows attackers to bypass these restrictions by removing this element.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

PTC — Mathcad

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2007-4600",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 4.6,
          "accessVector": "LOCAL",
          "vectorString": "AV:L/AC:L/Au:N/C:P/I:P/A:P",
          "authentication": "NONE",
          "integrityImpact": "PARTIAL",
          "accessComplexity": "LOW",
          "availabilityImpact": "PARTIAL",
          "confidentialityImpact": "PARTIAL"
        },
        "acInsufInfo": false,
        "impactScore": 6.4,
        "baseSeverity": "MEDIUM",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 3.9,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": true,
        "userInteractionRequired": false
      }
    ]
  },
  "affected": [
    {
      "source": "cve@mitre.org",
      "affectedData": [
        {
          "vendor": "n/a",
          "product": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ]
    }
  ],
  "published": "2007-10-18T20:17:00.000",
  "references": [
    {
      "url": "http://osvdb.org/43764",
      "source": "cve@mitre.org"
    },
    {
      "url": "http://securityreason.com/securityalert/3248",
      "source": "cve@mitre.org"
    },
    {
      "url": "http://www.securityfocus.com/archive/1/482341/100/0/threaded",
      "source": "cve@mitre.org"
    },
    {
      "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/37263",
      "source": "cve@mitre.org"
    },
    {
      "url": "http://osvdb.org/43764",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://securityreason.com/securityalert/3248",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.securityfocus.com/archive/1/482341/100/0/threaded",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/37263",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-264"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "The \"Protect Worksheet\" functionality in Mathsoft Mathcad 12 through 13.1, and PTC Mathcad 14, implements file access restrictions via a protection element in a gzipped XML file, which allows attackers to bypass these restrictions by removing this element."
    },
    {
      "lang": "es",
      "value": "La funcionalidad \"\" en Mathsoft Mathcad 12 hasta 13.1, y PTC Mathcad 14, implementa restricciones de acceso a fichero mediante un elemento de protección en un fichero XML comprimido con gzip, lo cual permite a atacantes remotos evitar estas restricciones eliminando este elemento."
    }
  ],
  "lastModified": "2026-06-16T22:44:24.687",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:ptc:mathcad:12:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "15F3DE89-8F0F-45F8-9D4D-A3BA2B913246"
            },
            {
              "criteria": "cpe:2.3:a:ptc:mathcad:13:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "40E72C5F-CB7B-4DC1-8B2D-86064A2EBD78"
            },
            {
              "criteria": "cpe:2.3:a:ptc:mathcad:13.1:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "66C68B0B-6542-401C-BE37-35FFA14DC562"
            },
            {
              "criteria": "cpe:2.3:a:ptc:mathcad:14:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "F9368917-7A10-44A1-A5F1-1453F77C7669"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "evaluatorComment": "Mathsoft sold mathcad to PTC in 2006.  PTC now supports all vulnerable versions.",
  "sourceIdentifier": "cve@mitre.org"
}