Unscored severity · published Feb 12, 2007
CVE-2007-0888
Directory traversal vulnerability in the TFTP server in Kiwi CatTools before 3.2.0 beta allows remote attackers to read arbitrary files, and upload files to arbitrary locations,…
–
CVSS
5.1%
EPSS
No
On KEV
Description
Directory traversal vulnerability in the TFTP server in Kiwi CatTools before 3.2.0 beta allows remote attackers to read arbitrary files, and upload files to arbitrary locations, via ..// (dot dot) sequences in the pathname argument to an FTP (1) GET or (2) PUT command.
Exploitation
Is it being used?
Exploit prediction (EPSS)5.1% · higher than 92% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
KC
Kiwi Cattools · Kiwi Enterprises
All versions, or not specified · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2007-0888
CVE.org
https://www.cve.org/CVERecord?id=CVE-2007-0888
secunia.com
http://secunia.com/advisories/24103
securityreason.com
http://securityreason.com/securityalert/2236
www.kiwisyslog.com
http://www.kiwisyslog.com/kb/idx/5/178/article/
www.osvdb.org
http://www.osvdb.org/33162
www.securityfocus.com
http://www.securityfocus.com/archive/1/459500/100/0/threaded
www.securityfocus.com
http://www.securityfocus.com/archive/1/459933/100/0/threaded
More from Kiwi Cattools
–
CVE-2007-0889
Kiwi CatTools before 3.2.0 beta uses weak encryption ("reversible encoding") for passwords, account names, and IP addresses in kiwidb-cattools.kdb, which might allow local users…