CVE-2007-5463
Last modified
CVE-2007-5463 is a vulnerability of currently unknown severity. ideal_process.php in the iDEAL payment module in ViArt Shop 3.3 beta and earlier might allow remote attackers to obtain the pathname for certificate and key files via an "iDEAL transaction", possibly involving fopen error messages for nonexistent files, a different issue than CVE-2007-5364. NOTE: this can be leveraged for reading certificate or key files if an installation places these files under the web document root.. EPSS estimates a 0.98% chance of exploitation in the next 30 days.
Description
ideal_process.php in the iDEAL payment module in ViArt Shop 3.3 beta and earlier might allow remote attackers to obtain the pathname for certificate and key files via an "iDEAL transaction", possibly involving fopen error messages for nonexistent files, a different issue than CVE-2007-5364. NOTE: this can be leveraged for reading certificate or key files if an installation places these files under the web document root.
Metrics
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Viart | Shop | <= 3.3_beta |
References
- http://secunia.com/advisories/27199Patch, Vendor Advisory
- http://secunia.com/advisories/27199Patch, Vendor Advisory
Timeline
- Published
- Last Modified
- Status
- Modified
Frequently Asked Questions
What is CVE-2007-5463?
How severe is CVE-2007-5463?
How do I fix CVE-2007-5463?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2007
- CVE-2007-5457Multiple PHP remote file inclusion vulnerabilities in Michae…
- CVE-2007-5458SQL injection vulnerability in index.php in the newsletter m…
- CVE-2007-5459Cross-site scripting (XSS) vulnerability in the sidebar HTML…
- CVE-2007-5460Microsoft ActiveSync 4.1, as used in Windows Mobile 5.0, use…4.6
- CVE-2007-5461Absolute path traversal vulnerability in Apache Tomcat 4.0.0…
- CVE-2007-5462Unspecified vulnerability in the Sun Solaris RPC services li…
- CVE-2007-5464Stack-based buffer overflow in Live for Speed 0.5X10 and ear…
- CVE-2007-5465Directory traversal vulnerability in doop CMS 1.3.7 and earl…
- CVE-2007-5466Multiple buffer overflows in eXtremail 2.1.1 and earlier all…
- CVE-2007-5467Integer overflow in eXtremail 2.1.1 and earlier allows remot…
- CVE-2007-5468Cisco CallManager 5.1.1.3000-5 does not verify the Digest au…
- CVE-2007-5469OpenSER 1.2.2 does not verify the Digest authentication head…
Are you affected by CVE-2007-5463?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST