CVE-2007-4982 - Vulnerability Details - OpenCVE

Multiple absolute path traversal vulnerabilities in the MW6QRCode.QRCode.1 ActiveX control in MW6QRCode.dll in MW6 Technologies QRCode ActiveX 3.0.0.1 and earlier allow remote attackers to create or overwrite arbitrary files via a full pathname in the argument to the (1) SaveAsBMP or (2) SaveAsWMF method. NOTE: some of these details are obtained from third party information.

No CVSS v4.0

No CVSS v3.1

No CVSS v3.0

Access Vector Network

Access Complexity Low

Authentication None

Confidentiality Impact Complete

Integrity Impact Complete

Availability Impact Complete

This CVE is not in the KEV list.

Key SSVC decision points have not yet been added.

Vendors	Products
Mw6 Technologies	Qrcode Activex

Configuration 1 [-]

cpe:2.3:a:mw6_technologies:qrcode_activex:*:*:*:*:*:*:*:*

No data.

References

Link	Providers
http://osvdb.org/37914
http://osvdb.org/37915
http://secunia.com/advisories/26836
http://www.securityfocus.com/bid/25702
http://www.shinnai.altervista.org/exploits/OREurGhGgAtlCT8J2jSY.html
http://www.vupen.com/english/advisories/2007/3195
https://exchange.xforce.ibmcloud.com/vulnerabilities/36666
https://www.exploit-db.com/exploits/4420

History

No history.

MITRE

Status: PUBLISHED

Assigner: mitre

Published: 2007-09-19T18:00:00

Updated: 2024-08-07T15:17:27.663Z

Reserved: 2007-09-19T00:00:00

Link: CVE-2007-4982

Vulnrichment

No data.

NVD

Status : Modified

Published: 2007-09-19T18:17:00.000

Modified: 2024-11-21T00:36:52.217

Link: CVE-2007-4982

Redhat

No data.

{"containers": {"cna": {"affected": [{"product": "n/a", "vendor": "n/a", "versions": [{"status": "affected", "version": "n/a"}]}], "datePublic": "2007-09-18T00:00:00", "descriptions": [{"lang": "en", "value": "Multiple absolute path traversal vulnerabilities in the MW6QRCode.QRCode.1 ActiveX control in MW6QRCode.dll in MW6 Technologies QRCode ActiveX 3.0.0.1 and earlier allow remote attackers to create or overwrite arbitrary files via a full pathname in the argument to the (1) SaveAsBMP or (2) SaveAsWMF method. NOTE: some of these details are obtained from third party information."}], "problemTypes": [{"descriptions": [{"description": "n/a", "lang": "en", "type": "text"}]}], "providerMetadata": {"dateUpdated": "2017-09-28T12:57:01", "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "shortName": "mitre"}, "references": [{"name": "25702", "tags": ["vdb-entry", "x_refsource_BID"], "url": "http://www.securityfocus.com/bid/25702"}, {"name": "37915", "tags": ["vdb-entry", "x_refsource_OSVDB"], "url": "http://osvdb.org/37915"}, {"name": "37914", "tags": ["vdb-entry", "x_refsource_OSVDB"], "url": "http://osvdb.org/37914"}, {"name": "26836", "tags": ["third-party-advisory", "x_refsource_SECUNIA"], "url": "http://secunia.com/advisories/26836"}, {"name": "4420", "tags": ["exploit", "x_refsource_EXPLOIT-DB"], "url": "https://www.exploit-db.com/exploits/4420"}, {"name": "ADV-2007-3195", "tags": ["vdb-entry", "x_refsource_VUPEN"], "url": "http://www.vupen.com/english/advisories/2007/3195"}, {"name": "mw6technologies-qrcode-file-overwrite(36666)", "tags": ["vdb-entry", "x_refsource_XF"], "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/36666"}, {"tags": ["x_refsource_MISC"], "url": "http://www.shinnai.altervista.org/exploits/OREurGhGgAtlCT8J2jSY.html"}], "x_legacyV4Record": {"CVE_data_meta": {"ASSIGNER": "cve@mitre.org", "ID": "CVE-2007-4982", "STATE": "PUBLIC"}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"product_name": "n/a", "version": {"version_data": [{"version_value": "n/a"}]}}]}, "vendor_name": "n/a"}]}}, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": {"description_data": [{"lang": "eng", "value": "Multiple absolute path traversal vulnerabilities in the MW6QRCode.QRCode.1 ActiveX control in MW6QRCode.dll in MW6 Technologies QRCode ActiveX 3.0.0.1 and earlier allow remote attackers to create or overwrite arbitrary files via a full pathname in the argument to the (1) SaveAsBMP or (2) SaveAsWMF method. NOTE: some of these details are obtained from third party information."}]}, "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "n/a"}]}]}, "references": {"reference_data": [{"name": "25702", "refsource": "BID", "url": "http://www.securityfocus.com/bid/25702"}, {"name": "37915", "refsource": "OSVDB", "url": "http://osvdb.org/37915"}, {"name": "37914", "refsource": "OSVDB", "url": "http://osvdb.org/37914"}, {"name": "26836", "refsource": "SECUNIA", "url": "http://secunia.com/advisories/26836"}, {"name": "4420", "refsource": "EXPLOIT-DB", "url": "https://www.exploit-db.com/exploits/4420"}, {"name": "ADV-2007-3195", "refsource": "VUPEN", "url": "http://www.vupen.com/english/advisories/2007/3195"}, {"name": "mw6technologies-qrcode-file-overwrite(36666)", "refsource": "XF", "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/36666"}, {"name": "http://www.shinnai.altervista.org/exploits/OREurGhGgAtlCT8J2jSY.html", "refsource": "MISC", "url": "http://www.shinnai.altervista.org/exploits/OREurGhGgAtlCT8J2jSY.html"}]}}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-07T15:17:27.663Z"}, "title": "CVE Program Container", "references": [{"name": "25702", "tags": ["vdb-entry", "x_refsource_BID", "x_transferred"], "url": "http://www.securityfocus.com/bid/25702"}, {"name": "37915", "tags": ["vdb-entry", "x_refsource_OSVDB", "x_transferred"], "url": "http://osvdb.org/37915"}, {"name": "37914", "tags": ["vdb-entry", "x_refsource_OSVDB", "x_transferred"], "url": "http://osvdb.org/37914"}, {"name": "26836", "tags": ["third-party-advisory", "x_refsource_SECUNIA", "x_transferred"], "url": "http://secunia.com/advisories/26836"}, {"name": "4420", "tags": ["exploit", "x_refsource_EXPLOIT-DB", "x_transferred"], "url": "https://www.exploit-db.com/exploits/4420"}, {"name": "ADV-2007-3195", "tags": ["vdb-entry", "x_refsource_VUPEN", "x_transferred"], "url": "http://www.vupen.com/english/advisories/2007/3195"}, {"name": "mw6technologies-qrcode-file-overwrite(36666)", "tags": ["vdb-entry", "x_refsource_XF", "x_transferred"], "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/36666"}, {"tags": ["x_refsource_MISC", "x_transferred"], "url": "http://www.shinnai.altervista.org/exploits/OREurGhGgAtlCT8J2jSY.html"}]}]}, "cveMetadata": {"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "assignerShortName": "mitre", "cveId": "CVE-2007-4982", "datePublished": "2007-09-19T18:00:00", "dateReserved": "2007-09-19T00:00:00", "dateUpdated": "2024-08-07T15:17:27.663Z", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.1"}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:mw6_technologies:qrcode_activex:*:*:*:*:*:*:*:*", "matchCriteriaId": "7C1F3621-DB8F-417F-87E2-6055236CDA5E", "versionEndIncluding": "3.0.0.1", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "descriptions": [{"lang": "en", "value": "Multiple absolute path traversal vulnerabilities in the MW6QRCode.QRCode.1 ActiveX control in MW6QRCode.dll in MW6 Technologies QRCode ActiveX 3.0.0.1 and earlier allow remote attackers to create or overwrite arbitrary files via a full pathname in the argument to the (1) SaveAsBMP or (2) SaveAsWMF method. NOTE: some of these details are obtained from third party information."}, {"lang": "es", "value": "M\u00faltiples vulnerabilidades de salto de directorio absoluto en el control ActiveX MW6QRCode.QRCode.1 de MW6QRCode.dll en MW6 Technologies QRCode ActiveX 3.0.0.1 y anteriores permiten a atacantes remotos crear o sobrescribir ficheros locales de su elecci\u00f3n mediante nombre de ruta completo en el argumento a los m\u00e9todos (1) SaveAsBMP o (2) SaveAsWMF. NOTA: algunos de estos detalles se han obtenido de informaci\u00f3n de terceros."}], "id": "CVE-2007-4982", "lastModified": "2024-11-21T00:36:52.217", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "HIGH", "cvssData": {"accessComplexity": "LOW", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "COMPLETE", "baseScore": 10.0, "confidentialityImpact": "COMPLETE", "integrityImpact": "COMPLETE", "vectorString": "AV:N/AC:L/Au:N/C:C/I:C/A:C", "version": "2.0"}, "exploitabilityScore": 10.0, "impactScore": 10.0, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": false}]}, "published": "2007-09-19T18:17:00.000", "references": [{"source": "cve@mitre.org", "url": "http://osvdb.org/37914"}, {"source": "cve@mitre.org", "url": "http://osvdb.org/37915"}, {"source": "cve@mitre.org", "tags": ["Vendor Advisory"], "url": "http://secunia.com/advisories/26836"}, {"source": "cve@mitre.org", "url": "http://www.securityfocus.com/bid/25702"}, {"source": "cve@mitre.org", "url": "http://www.shinnai.altervista.org/exploits/OREurGhGgAtlCT8J2jSY.html"}, {"source": "cve@mitre.org", "url": "http://www.vupen.com/english/advisories/2007/3195"}, {"source": "cve@mitre.org", "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/36666"}, {"source": "cve@mitre.org", "url": "https://www.exploit-db.com/exploits/4420"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://osvdb.org/37914"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://osvdb.org/37915"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Vendor Advisory"], "url": "http://secunia.com/advisories/26836"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://www.securityfocus.com/bid/25702"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://www.shinnai.altervista.org/exploits/OREurGhGgAtlCT8J2jSY.html"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://www.vupen.com/english/advisories/2007/3195"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/36666"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "https://www.exploit-db.com/exploits/4420"}], "sourceIdentifier": "cve@mitre.org", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-22"}], "source": "nvd@nist.gov", "type": "Primary"}]}