CVE-2007-5278 - CVE House
Back to Database
Status published Medium CVE-2007-5278

Zomplog 3.8.1 and earlier stores potentially sensitive information under the...

Vulnerability Description

Zomplog 3.8.1 and earlier stores potentially sensitive information under the web root with insufficient access control, which allows remote attackers to download files that were uploaded by users, as demonstrated by obtaining a directory listing via a direct request to /upload and then retrieving individual files. NOTE: in a non-default configuration, the directory listing is denied, but filenames may be predicable.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2007-5278

Credits & Attribution

No credits recorded in the NVD database.

References

More from zomplog

View All →
CVE-2007-5231
Unrestricted file upload vulnerability in admin/upload_files.php in Zomplog 3.8.1 and...
Medium 4.6
CVE-2007-5230
admin/upload_files.php in Zomplog 3.8.1 and earlier does not check for...
High 7.5
CVE-2007-2773
SQL injection vulnerability in plugins/mp3playlist/mp3playlist.php in Zomplog 3.8 and earlier...
High 7.5
CVE-2007-2157
Directory traversal vulnerability in upload/force_download.php in Zomplog 3.8 allows remote...
High 7.8
CVE-2007-1524
Directory traversal vulnerability in themes/default/ in ZomPlog 3.7.6 and earlier...
Medium 5

Affected Vendor

Affected Software

zomplog
Vulnerable Versions:
3.8.1

Timeline

Official Publish: October 8th, 2007
Last Modified: August 7th, 2024
Added to House: July 18th, 2026

CVSS Vectors

Weaknesses (CWE)

No CWE data available

MITRE ATT&CK TTPs

No associated TTPs found for this vulnerability.