vulnwire
4.0med

CVE-2007-53201 exploit

Multiple absolute path traversal vulnerabilities in Pegasus Imaging ImagXpress 8.0 allow remote attackers to (1) delete arbitrary files via…

Published 19 y ago · modified 4 mo ago · JSON

CVSS
4.0
v2.0 · NVD
CISA KEV
No
not known exploited
EPSS
6.5%
percentile 94%
Public exploits
1
Exploit-DB

Multiple absolute path traversal vulnerabilities in Pegasus Imaging ImagXpress 8.0 allow remote attackers to (1) delete arbitrary files via the CacheFile attribute in the ThumbnailXpres.1 ActiveX control (PegasusImaging.ActiveX.ThumnailXpress1.dll) or (2) overwrite arbitrary files via the CompactFile function in the ImagXpress.8 ActiveX control (PegasusImaging.ActiveX.ImagXpress8.dll).

Exploit prediction (EPSS)

6.51% probability of exploitation in the next 30 days, higher than 94% of all scored CVEs.

Exploits and detections

  • EDB-4488 Pegasus Imaging ImagXpress 8.0 - Arbitrary File Overwrite · remote · 2007-10-05

CVSS scores

Assigned byVersionScoreVector
NVD2.04.0AV:N/AC:H/Au:N/C:N/I:P/A:P

Classification

Weakness
  • CWE-22 Improper Limitation of a Pathname to a Restricted Directory

References

  • securityfocus.com /bid/25948 · vdb-entry, x_refsource_BID, x_transferred
  • shinnai.altervista.org /exploits/txt/TXT_3DQ1nIkI6zmWCek4zP5U.html · x_refsource_MISC, x_transferred
  • osvdb.org /37959 · vdb-entry, x_refsource_OSVDB, x_transferred
  • secunia.com /advisories/27095 · third-party-advisory, x_refsource_SECUNIA, x_transferred
  • vupen.com /english/advisories/2007/3388 · vdb-entry, x_refsource_VUPEN, x_transferred
  • shinnai.altervista.org /exploits/txt/TXT_wfv7ZG0G6KnQlk1SieLd.html · x_refsource_MISC, x_transferred
  • exchange.xforce.ibmcloud.com /vulnerabilities/37012 · vdb-entry, x_refsource_XF, x_transferred
  • securityfocus.com /bid/25949 · vdb-entry, x_refsource_BID, x_transferred
  • osvdb.org /37960 · vdb-entry, x_refsource_OSVDB, x_transferred

Sources

vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.