« Volver al listado

CVE-2007-5734

Estado: ModificadaMedia (6.4)—

Vulnerabilidad de actualización de archivo no restringido en eFileMan 7.1.0.87-88 permite a atacantes remotos actualizar archivos, con nombres de archivo de destino "uploads/upload_file.", a través de vectores no especificados, en upload.cgi, accediendo desde upload.html.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

Efileman — Efileman

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2007-5734",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 6.4,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:L/Au:N/C:N/I:P/A:P",
          "authentication": "NONE",
          "integrityImpact": "PARTIAL",
          "accessComplexity": "LOW",
          "availabilityImpact": "PARTIAL",
          "confidentialityImpact": "NONE"
        },
        "acInsufInfo": false,
        "impactScore": 4.9,
        "baseSeverity": "MEDIUM",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 10,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": false
      }
    ]
  },
  "affected": [
    {
      "source": "cve@mitre.org",
      "affectedData": [
        {
          "vendor": "n/a",
          "product": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ]
    }
  ],
  "published": "2007-10-30T23:46:00.000",
  "references": [
    {
      "url": "http://osvdb.org/39013",
      "source": "cve@mitre.org"
    },
    {
      "url": "http://securityreason.com/securityalert/3323",
      "source": "cve@mitre.org"
    },
    {
      "url": "http://www.securityfocus.com/archive/1/482683/100/0/threaded",
      "source": "cve@mitre.org"
    },
    {
      "url": "http://www.securityfocus.com/bid/26184",
      "source": "cve@mitre.org"
    },
    {
      "url": "http://osvdb.org/39013",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://securityreason.com/securityalert/3323",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.securityfocus.com/archive/1/482683/100/0/threaded",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.securityfocus.com/bid/26184",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-20"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Unrestricted file upload vulnerability in eFileMan 7.1.0.87-88 allows remote attackers to upload arbitrary files, with \"uploads/upload_file.\" destination filenames, via unspecified vectors to upload.cgi, accessed from upload.html."
    },
    {
      "lang": "es",
      "value": "Vulnerabilidad de actualización de archivo no restringido en eFileMan 7.1.0.87-88 permite a atacantes remotos actualizar archivos, con nombres de archivo de destino \"uploads/upload_file.\", a través de vectores no especificados, en upload.cgi, accediendo desde upload.html.\r\n"
    }
  ],
  "lastModified": "2026-06-16T22:46:43.697",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:efileman:efileman:7.1.0.87_88:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "A4A6F902-97B5-427B-90DE-1D64A0E74C6C"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "cve@mitre.org"
}