CVE-2007-2157 - Vulnerability Details - OpenCVE

Directory traversal vulnerability in upload/force_download.php in Zomplog 3.8 allows remote attackers to read arbitrary files via a .. (dot dot) in the file parameter.

No CVSS v4.0

No CVSS v3.1

No CVSS v3.0

Access Vector Network

Access Complexity Low

Authentication None

Confidentiality Impact Complete

Integrity Impact None

Availability Impact None

This CVE is not in the KEV list.

Key SSVC decision points have not yet been added.

Vendors	Products
Zomplog	Zomplog

Configuration 1 [-]

cpe:2.3:a:zomplog:zomplog:3.8:*:*:*:*:*:*:*

No data.

References

Link	Providers
http://osvdb.org/35016
http://secunia.com/advisories/24899
http://www.securityfocus.com/bid/23553
http://www.vupen.com/english/advisories/2007/1449
https://exchange.xforce.ibmcloud.com/vulnerabilities/33740
https://www.exploit-db.com/exploits/3764

History

No history.

MITRE

Status: PUBLISHED

Assigner: mitre

Published: 2007-04-19T10:00:00

Updated: 2024-08-07T13:23:51.013Z

Reserved: 2007-04-19T00:00:00

Link: CVE-2007-2157

Vulnrichment

No data.

NVD

Status : Deferred

Published: 2007-04-19T10:19:00.000

Modified: 2025-04-09T00:30:58.490

Link: CVE-2007-2157

Redhat

No data.

{"containers": {"cna": {"affected": [{"product": "n/a", "vendor": "n/a", "versions": [{"status": "affected", "version": "n/a"}]}], "datePublic": "2007-04-18T00:00:00", "descriptions": [{"lang": "en", "value": "Directory traversal vulnerability in upload/force_download.php in Zomplog 3.8 allows remote attackers to read arbitrary files via a .. (dot dot) in the file parameter."}], "problemTypes": [{"descriptions": [{"description": "n/a", "lang": "en", "type": "text"}]}], "providerMetadata": {"dateUpdated": "2017-10-10T00:57:01", "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "shortName": "mitre"}, "references": [{"name": "ADV-2007-1449", "tags": ["vdb-entry", "x_refsource_VUPEN"], "url": "http://www.vupen.com/english/advisories/2007/1449"}, {"name": "zomplog-forcedownload-dir-traversal(33740)", "tags": ["vdb-entry", "x_refsource_XF"], "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/33740"}, {"name": "3764", "tags": ["exploit", "x_refsource_EXPLOIT-DB"], "url": "https://www.exploit-db.com/exploits/3764"}, {"name": "35016", "tags": ["vdb-entry", "x_refsource_OSVDB"], "url": "http://osvdb.org/35016"}, {"name": "24899", "tags": ["third-party-advisory", "x_refsource_SECUNIA"], "url": "http://secunia.com/advisories/24899"}, {"name": "23553", "tags": ["vdb-entry", "x_refsource_BID"], "url": "http://www.securityfocus.com/bid/23553"}], "x_legacyV4Record": {"CVE_data_meta": {"ASSIGNER": "cve@mitre.org", "ID": "CVE-2007-2157", "STATE": "PUBLIC"}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"product_name": "n/a", "version": {"version_data": [{"version_value": "n/a"}]}}]}, "vendor_name": "n/a"}]}}, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": {"description_data": [{"lang": "eng", "value": "Directory traversal vulnerability in upload/force_download.php in Zomplog 3.8 allows remote attackers to read arbitrary files via a .. (dot dot) in the file parameter."}]}, "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "n/a"}]}]}, "references": {"reference_data": [{"name": "ADV-2007-1449", "refsource": "VUPEN", "url": "http://www.vupen.com/english/advisories/2007/1449"}, {"name": "zomplog-forcedownload-dir-traversal(33740)", "refsource": "XF", "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/33740"}, {"name": "3764", "refsource": "EXPLOIT-DB", "url": "https://www.exploit-db.com/exploits/3764"}, {"name": "35016", "refsource": "OSVDB", "url": "http://osvdb.org/35016"}, {"name": "24899", "refsource": "SECUNIA", "url": "http://secunia.com/advisories/24899"}, {"name": "23553", "refsource": "BID", "url": "http://www.securityfocus.com/bid/23553"}]}}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-07T13:23:51.013Z"}, "title": "CVE Program Container", "references": [{"name": "ADV-2007-1449", "tags": ["vdb-entry", "x_refsource_VUPEN", "x_transferred"], "url": "http://www.vupen.com/english/advisories/2007/1449"}, {"name": "zomplog-forcedownload-dir-traversal(33740)", "tags": ["vdb-entry", "x_refsource_XF", "x_transferred"], "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/33740"}, {"name": "3764", "tags": ["exploit", "x_refsource_EXPLOIT-DB", "x_transferred"], "url": "https://www.exploit-db.com/exploits/3764"}, {"name": "35016", "tags": ["vdb-entry", "x_refsource_OSVDB", "x_transferred"], "url": "http://osvdb.org/35016"}, {"name": "24899", "tags": ["third-party-advisory", "x_refsource_SECUNIA", "x_transferred"], "url": "http://secunia.com/advisories/24899"}, {"name": "23553", "tags": ["vdb-entry", "x_refsource_BID", "x_transferred"], "url": "http://www.securityfocus.com/bid/23553"}]}]}, "cveMetadata": {"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "assignerShortName": "mitre", "cveId": "CVE-2007-2157", "datePublished": "2007-04-19T10:00:00", "dateReserved": "2007-04-19T00:00:00", "dateUpdated": "2024-08-07T13:23:51.013Z", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.1"}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:zomplog:zomplog:3.8:*:*:*:*:*:*:*", "matchCriteriaId": "6943921A-5615-41FD-A50B-E38AB4358175", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Directory traversal vulnerability in upload/force_download.php in Zomplog 3.8 allows remote attackers to read arbitrary files via a .. (dot dot) in the file parameter."}, {"lang": "es", "value": "Vulnerabilidad de escalado de directorio en upload/force_download.php de Zomplog 3.8 permite a atacantes remotos leer ficheros de su elecci\u00f3n mediante un .. (punto punto) en el par\u00e1metro file."}], "id": "CVE-2007-2157", "lastModified": "2025-04-09T00:30:58.490", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "HIGH", "cvssData": {"accessComplexity": "LOW", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "NONE", "baseScore": 7.8, "confidentialityImpact": "COMPLETE", "integrityImpact": "NONE", "vectorString": "AV:N/AC:L/Au:N/C:C/I:N/A:N", "version": "2.0"}, "exploitabilityScore": 10.0, "impactScore": 6.9, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": false}]}, "published": "2007-04-19T10:19:00.000", "references": [{"source": "cve@mitre.org", "url": "http://osvdb.org/35016"}, {"source": "cve@mitre.org", "url": "http://secunia.com/advisories/24899"}, {"source": "cve@mitre.org", "url": "http://www.securityfocus.com/bid/23553"}, {"source": "cve@mitre.org", "url": "http://www.vupen.com/english/advisories/2007/1449"}, {"source": "cve@mitre.org", "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/33740"}, {"source": "cve@mitre.org", "url": "https://www.exploit-db.com/exploits/3764"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://osvdb.org/35016"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://secunia.com/advisories/24899"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://www.securityfocus.com/bid/23553"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://www.vupen.com/english/advisories/2007/1449"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/33740"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "https://www.exploit-db.com/exploits/3764"}], "sourceIdentifier": "cve@mitre.org", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "NVD-CWE-Other"}], "source": "nvd@nist.gov", "type": "Primary"}]}