CVE-2007-3008

{"id": "CVE-2007-3008", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 4.3, "accessVector": "NETWORK", "vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N", "authentication": "NONE", "integrityImpact": "PARTIAL", "accessComplexity": "MEDIUM", "availabilityImpact": "NONE", "confidentialityImpact": "NONE"}, "acInsufInfo": false, "impactScore": 2.9, "baseSeverity": "MEDIUM", "obtainAllPrivilege": false, "exploitabilityScore": 8.6, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": true}]}, "published": "2007-06-04T17:30:00.000", "references": [{"url": "http://secunia.com/advisories/25636", "tags": ["Vendor Advisory"], "source": "cve@mitre.org"}, {"url": "http://www.appwebserver.org/forum/viewtopic.php?t=996", "source": "cve@mitre.org"}, {"url": "http://www.mbedthis.com/products/appWeb/doc/product/newFeatures.html", "source": "cve@mitre.org"}, {"url": "http://www.osvdb.org/35511", "source": "cve@mitre.org"}, {"url": "http://www.securityfocus.com/bid/24456", "source": "cve@mitre.org"}, {"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/34854", "source": "cve@mitre.org"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-200"}, {"lang": "en", "value": "CWE-79"}]}], "descriptions": [{"lang": "en", "value": "Mbedthis AppWeb before 2.2.2 enables the HTTP TRACE method, which has unspecified impact probably related to remote information leaks and cross-site tracing (XST) attacks, a related issue to CVE-2004-2320 and CVE-2005-3398."}, {"lang": "es", "value": "Mbedthis AppWeb before 2.2.2 habilita el m\u00e9todo HTTP TRACE, el cual tiene un impacto desconocido probablemente relacionado con una filtraci\u00f3n informaci\u00f3n remota y ataques de trazado en sitios cruzados (XST) en CVE-2004-2320 y CVE-2005-3398."}], "lastModified": "2017-07-29T01:31:54.830", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:mbedthis_software:mbedthis_appweb_http_server:2.0.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "F033C9F0-7F7B-41A9-9F64-74E61738540A"}, {"criteria": "cpe:2.3:a:mbedthis_software:mbedthis_appweb_http_server:2.0.1:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "E9D1ABC1-7BB1-450B-96A7-FCECC6ADEF5C"}, {"criteria": "cpe:2.3:a:mbedthis_software:mbedthis_appweb_http_server:2.0.2:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "EA0D3EAF-BC9E-4ADD-92CE-9CA29D1AD868"}, {"criteria": "cpe:2.3:a:mbedthis_software:mbedthis_appweb_http_server:2.0.3:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "5283B862-1325-49C7-961D-52BDD3616B33"}, {"criteria": "cpe:2.3:a:mbedthis_software:mbedthis_appweb_http_server:2.0.4:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "1381FB59-0520-4620-8B92-FDB3EDE4A5D7"}, {"criteria": "cpe:2.3:a:mbedthis_software:mbedthis_appweb_http_server:2.0.5:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "3CD4B710-951B-4CF3-9E34-D7AF33B4A25A"}, {"criteria": "cpe:2.3:a:mbedthis_software:mbedthis_appweb_http_server:2.1.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "33ECBD48-2547-4482-8AFD-96D08390A06E"}, {"criteria": "cpe:2.3:a:mbedthis_software:mbedthis_appweb_http_server:2.1.1:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "370B4D32-536C-4BC5-AF68-8851C3C8B55C"}, {"criteria": "cpe:2.3:a:mbedthis_software:mbedthis_appweb_http_server:2.2.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "76D650D5-588D-42A7-8ACF-37BEA78A7A8D"}, {"criteria": "cpe:2.3:a:mbedthis_software:mbedthis_appweb_http_server:2.2.1:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "54CB5569-3E74-4ADB-A286-E085717C00D7"}], "operator": "OR"}]}], "vendorComments": [{"comment": "The Apache Software Foundation do not treat this as a security issue. A configuration change can be made to disable the ability to respond to HTTP TRACE requests if required.\n\nFor more information please see:\nhttp://www.apacheweek.com/issues/03-01-24#news", "lastModified": "2008-03-05T00:00:00", "organization": "Red Hat"}], "sourceIdentifier": "cve@mitre.org"}