CVE-2007-4180

State: Published
Severity: Not scored
Published: Aug 8, 2007
Updated: Aug 7, 2024
Reserved: Aug 7, 2007

Description

Directory traversal vulnerability in data/inc/theme.php in Pluck 4.3, when register_globals is enabled, allows remote attackers to read arbitrary local files via a .. (dot dot) in the file parameter. NOTE: CVE and a reliable third party dispute this vulnerability because the code uses a fixed argument when invoking fputs, which cannot be used to read files

Scores

The record has no CVSS score.

Weaknesses

The record names no weakness.

Affected Products

Product	Versions
n/an/a	n/aAffected

References

pluck-theme-directory-traversal(35757)vdb-entry
2973third-party-advisory
20070802 False: Pluck 4.3 themes.php Remote File Inclusion and disclosuremailing-list
20070802 Pluck 4.3 themes.php Remote File Inclusion and disclosuremailing-list
http://outlaw.aria-security.info/?p=12

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.