« Volver al listado

CVE-2007-5987

Estado: ModificadaMedia (6.8)—

details.php en BtiTracker anterior a 1.4.5, cuando la vista del torrent está desactivada para invitados, permite a atacantes remotos evitar los mecanismos de protección a través de una respuesta directa, como se demostró con (1) la lectura de de detalles de una torrent de su elección y (2) modificar un torrent propietario por un invitado.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

Bti-tracker — Bti-tracker

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2007-5987",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 6.8,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P",
          "authentication": "NONE",
          "integrityImpact": "PARTIAL",
          "accessComplexity": "MEDIUM",
          "availabilityImpact": "PARTIAL",
          "confidentialityImpact": "PARTIAL"
        },
        "acInsufInfo": false,
        "impactScore": 6.4,
        "baseSeverity": "MEDIUM",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 8.6,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": true,
        "userInteractionRequired": false
      }
    ]
  },
  "affected": [
    {
      "source": "cve@mitre.org",
      "affectedData": [
        {
          "vendor": "n/a",
          "product": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ]
    }
  ],
  "published": "2007-11-15T00:46:00.000",
  "references": [
    {
      "url": "http://osvdb.org/42217",
      "source": "cve@mitre.org"
    },
    {
      "url": "http://secunia.com/advisories/27550",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "cve@mitre.org"
    },
    {
      "url": "http://sourceforge.net/project/shownotes.php?release_id=552477",
      "tags": [
        "Patch"
      ],
      "source": "cve@mitre.org"
    },
    {
      "url": "http://sourceforge.net/tracker/index.php?func=detail&aid=1748243&group_id=146822&atid=766508",
      "source": "cve@mitre.org"
    },
    {
      "url": "http://www.securityfocus.com/bid/26551",
      "source": "cve@mitre.org"
    },
    {
      "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/38416",
      "source": "cve@mitre.org"
    },
    {
      "url": "http://osvdb.org/42217",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://secunia.com/advisories/27550",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://sourceforge.net/project/shownotes.php?release_id=552477",
      "tags": [
        "Patch"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://sourceforge.net/tracker/index.php?func=detail&aid=1748243&group_id=146822&atid=766508",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.securityfocus.com/bid/26551",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/38416",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-264"
        },
        {
          "lang": "en",
          "value": "CWE-287"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "details.php in BtiTracker before 1.4.5, when torrent viewing is disabled for guests, allows remote attackers to bypass protection mechanisms via a direct request, as demonstrated by (1) reading the details of an arbitrary torrent and (2) modifying a torrent owned by a guest."
    },
    {
      "lang": "es",
      "value": "details.php en BtiTracker anterior a 1.4.5, cuando la vista del torrent está desactivada para invitados, permite a atacantes remotos evitar los mecanismos de protección a través de una respuesta directa, como se demostró con (1) la lectura de de detalles de una torrent de su elección y (2) modificar un torrent propietario por un invitado."
    }
  ],
  "lastModified": "2026-06-16T22:47:12.623",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:bti-tracker:bti-tracker:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "9560BC2B-ABA6-4E3E-BC5F-39FA81A7056B",
              "versionEndIncluding": "1.3.2"
            },
            {
              "criteria": "cpe:2.3:a:bti-tracker:bti-tracker:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "976C17BA-0AC3-4CAB-A71F-1C8FF82BDEB3",
              "versionEndIncluding": "1.4.1"
            },
            {
              "criteria": "cpe:2.3:a:bti-tracker:bti-tracker:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "345E41A1-5BB7-47EE-9493-0A57FF62BD2A",
              "versionEndIncluding": "1.4.2"
            },
            {
              "criteria": "cpe:2.3:a:bti-tracker:bti-tracker:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "B4FDB846-596B-4149-9B81-34094B60D4DA",
              "versionEndIncluding": "1.4.3"
            },
            {
              "criteria": "cpe:2.3:a:bti-tracker:bti-tracker:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "FD2AAEE7-3AA7-4A94-AEF1-23DE0EC74037",
              "versionEndIncluding": "1.4.4"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "cve@mitre.org"
}