critical9.3Public exploit code
CVE-2007-4420
Absolute path traversal vulnerability in a certain ActiveX control in officeviewer.ocx 5.1.199.1 in EDraw Office Viewer Component 5.1 allows remote attackers t…
Public exploit code
Working exploit or proof of concept code has been published for this vulnerability. Treat unpatched systems as at risk.
- EDraw Office Viewer Component 5.1 - HttpDownloadFile() Insecure Method2007-08-16 · remote · windows · Verified
Impact
Absolute path traversal vulnerability in a certain ActiveX control in officeviewer.ocx 5.1.199.1 in EDraw Office Viewer Component 5.1 allows remote attackers to create or overwrite arbitrary files via a full pathname in the second argument to the HttpDownloadFile method, a different vulnerability than CVE-2007-3168 and CVE-2007-3169.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Edraw | Office Viewer Component | Version 5.1 |
Weakness classification
References
- NVD record
- CVE.org record
- http://osvdb.org/38794
- http://www.ocxt.com/archives/39
- http://www.securityfocus.com/bid/25344
- https://exchange.xforce.ibmcloud.com/vulnerabilities/36055
- https://www.exploit-db.com/exploits/4290
- http://osvdb.org/38794
- http://www.ocxt.com/archives/39
- http://www.securityfocus.com/bid/25344
- https://exchange.xforce.ibmcloud.com/vulnerabilities/36055
- https://www.exploit-db.com/exploits/4290