« Volver al listado

CVE-2007-5654

Estado: ModificadaMedia (5)—

LiteSpeed Web Server before 3.2.4 allows remote attackers to trigger use of an arbitrary MIME type for a file via a "%00." sequence followed by a new extension, as demonstrated by reading PHP source code via requests for .php%00.txt files, aka "Mime Type Injection."

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

Litespeed Technologies — Litespeed WEB Server

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2007-5654",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 5,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:N",
          "authentication": "NONE",
          "integrityImpact": "NONE",
          "accessComplexity": "LOW",
          "availabilityImpact": "NONE",
          "confidentialityImpact": "PARTIAL"
        },
        "acInsufInfo": false,
        "impactScore": 2.9,
        "baseSeverity": "MEDIUM",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 10,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": false
      }
    ]
  },
  "affected": [
    {
      "source": "cve@mitre.org",
      "affectedData": [
        {
          "vendor": "n/a",
          "product": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ]
    }
  ],
  "published": "2007-10-23T21:47:00.000",
  "references": [
    {
      "url": "http://osvdb.org/41867",
      "source": "cve@mitre.org"
    },
    {
      "url": "http://secunia.com/advisories/27302",
      "source": "cve@mitre.org"
    },
    {
      "url": "http://www.litespeedtech.com/latest/litespeed-web-server-3.2.4-released.html",
      "source": "cve@mitre.org"
    },
    {
      "url": "http://www.securityfocus.com/bid/26163",
      "source": "cve@mitre.org"
    },
    {
      "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/37380",
      "source": "cve@mitre.org"
    },
    {
      "url": "https://www.exploit-db.com/exploits/4556",
      "source": "cve@mitre.org"
    },
    {
      "url": "http://osvdb.org/41867",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://secunia.com/advisories/27302",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.litespeedtech.com/latest/litespeed-web-server-3.2.4-released.html",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.securityfocus.com/bid/26163",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/37380",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://www.exploit-db.com/exploits/4556",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-200"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "LiteSpeed Web Server before 3.2.4 allows remote attackers to trigger use of an arbitrary MIME type for a file via a \"%00.\" sequence followed by a new extension, as demonstrated by reading PHP source code via requests for .php%00.txt files, aka \"Mime Type Injection.\""
    },
    {
      "lang": "es",
      "value": "LiteSpeed Web Server anterior a 3.2.4 permite a atacantes remotos disparar la utilización de un tipo MIME de su elección para un archivo a través de una secuencia \"%00.\" seguida de una nueva extensión, como se demostró con la lectura del código fuente PHP a través de respuestas para archivos .php%00.txt, también conocido como \"Inyección tipo MIME\"."
    }
  ],
  "lastModified": "2026-06-16T22:46:34.710",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:litespeed_technologies:litespeed_web_server:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "57B7A5F5-805C-4A82-B869-2029C27B88A5",
              "versionEndIncluding": "3.2.3"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "cve@mitre.org"
}