CVE-2007-6350 : scponly 4.6 and earlier allows remote authenticated users to bypass intended res

scponly 4.6 and earlier allows remote authenticated users to bypass intended restrictions and execute code by invoking dangerous subcommands including (1) unison, (2) rsync, (3) svn, and (4) svnserve, as originally demonstrated by creating a Subversion (SVN) repository with malicious hooks, then using svn to trigger execution of those hooks.

Published 2007-12-14 20:46:00

Updated 2011-08-08 04:00:00

Source MITRE

View at NVD, CVE.org

Vulnerability category: Execute code

Products affected by CVE-2007-6350

Scponly » Scponly
Versions up to, including, (<=) 4.6
cpe:2.3:a:scponly:scponly:*:*:*:*:*:*:*:*
Matching versions
Scponly » Scponly » Version: 4.5
cpe:2.3:a:scponly:scponly:4.5:*:*:*:*:*:*:*
Matching versions
Scponly » Scponly » Version: 4.4
cpe:2.3:a:scponly:scponly:4.4:*:*:*:*:*:*:*
Matching versions
Scponly » Scponly » Version: 4.3
cpe:2.3:a:scponly:scponly:4.3:*:*:*:*:*:*:*
Matching versions
Scponly » Scponly » Version: 4.2
cpe:2.3:a:scponly:scponly:4.2:*:*:*:*:*:*:*
Matching versions

Exploit prediction scoring system (EPSS) score for CVE-2007-6350

EPSS FAQ

1.28%

Probability of exploitation activity in the next 30 days EPSS Score History

~ 86 %

Percentile, the proportion of vulnerabilities that are scored at or less

CVSS scores for CVE-2007-6350

Base Score	Base Severity	CVSS Vector	Exploitability Score	Impact Score	Score Source	First Seen
8.5	HIGH	AV:N/AC:M/Au:S/C:C/I:C/A:C	6.8	10.0	NIST
Access Vector: Network Access Complexity: Medium Authentication: Single Confidentiality Impact: Complete Integrity Impact: Complete Availability Impact: Complete

CWE ids for CVE-2007-6350

CWE-264

Assigned by: nvd@nist.gov (Primary)

References for CVE-2007-6350

Jump to

Vulnerability Details : CVE-2007-6350

Products affected by CVE-2007-6350

Exploit prediction scoring system (EPSS) score for CVE-2007-6350

CVSS scores for CVE-2007-6350

CWE ids for CVE-2007-6350

References for CVE-2007-6350