vulnwire
5.0med

CVE-2007-5463

ideal_process.php in the iDEAL payment module in ViArt Shop 3.3 beta and earlier might allow remote attackers to obtain the pathname for ce…

Published 19 y ago · modified 4 mo ago · JSON

CVSS
5.0
v2.0 · NVD
CISA KEV
No
not known exploited
EPSS
1.0%
percentile 62%
Public exploits
0
none known

ideal_process.php in the iDEAL payment module in ViArt Shop 3.3 beta and earlier might allow remote attackers to obtain the pathname for certificate and key files via an "iDEAL transaction", possibly involving fopen error messages for nonexistent files, a different issue than CVE-2007-5364. NOTE: this can be leveraged for reading certificate or key files if an installation places these files under the web document root.

Exploit prediction (EPSS)

0.98% probability of exploitation in the next 30 days, higher than 62% of all scored CVEs.

CVSS scores

Assigned byVersionScoreVector
NVD2.05.0AV:N/AC:L/Au:N/C:P/I:N/A:N

Classification

Weakness
  • CWE-22 Improper Limitation of a Pathname to a Restricted Directory

References

  • securityreason.com /securityalert/3233 · third-party-advisory, x_refsource_SREASON, x_transferred
  • securityfocus.com /archive/1/481978/100/0/threaded · mailing-list, x_refsource_BUGTRAQ, x_transferred
  • viart.com /ideal_process_script_fix_for_release_32_and_33_beta.html · x_refsource_CONFIRM, x_transferred
  • osvdb.org /40151 · vdb-entry, x_refsource_OSVDB, x_transferred
  • secunia.com /advisories/27199 · third-party-advisory, x_refsource_SECUNIA, x_transferred
  • securityfocus.com /bid/25998 · vdb-entry, x_refsource_BID, x_transferred
  • exchange.xforce.ibmcloud.com /vulnerabilities/37048 · vdb-entry, x_refsource_XF, x_transferred

Sources

vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.