CVE-2007-3816
- State
- Published
- Severity
- 7.5 High
- Published
- Jul 17, 2007
- Updated
- Jan 17, 2025
- Reserved
- Jul 16, 2007
Description
JWIG might allow context-dependent attackers to cause a denial of service (service degradation) via loops of references to external templates. NOTE: this issue has been disputed by multiple third parties who state that only the application developer can trigger the issue, so no privilege boundaries are crossed. However, it seems possible that this is a vulnerability class to which an JWIG application may be vulnerable if template contents can be influenced, but this would be an issue in the application itself, not JWIG
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 3.1 | 7.5 High | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H | CISA-ADP |
Weaknesses
The record names no weakness.
Affected Products
| Product | Versions |
|---|---|
n/an/a |
|
References
- 20070723 [CVE 2007-3816] [Advisory] Vulnerability Facts Related JWIG Advisorymailing-list
- jwig-externaltemplate-dos(35515)vdb-entry
- 20070716 WhitePapers By SecNiche Securitymailing-list
- http://www.secniche.org/papers/HackAnnotationsInJWIG.pdf
- 20070721 [CVE-2007-3816][Advisory] JWIG Context-Dependent Template Calling Dosmailing-list
- 1018432vdb-entry
- 20070721 Re: [WEB SECURITY] [CVE-2007-3816][Advisory] JWIG Context-Dependent Template Calling Dosmailing-list
- 24974vdb-entry
- 20070721 [CVE-2007-3816][Advisory] JWIG Context-Dependent Template Calling Dosmailing-list
- 20070722 Re: [CVE 2007-3816] [Advisory] Vulnerability Facts Related JWIG Advisorymailing-list
- 20070726 [CVE 2007-3816] [Advisory] Vulnerability Facts Related JWIG Advisorymailing-list
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.