1. Home
  2. CVE Database
  3. CVE-2007-0681
CRITICAL · 9.8

CVE-2007-0681

profile.php in ExtCalendar 2 and earlier allows remote attackers to change the passwords of arbitrary users without providing the original password, and possibly perform other unauthorized actions, vi...

Vulnerability Description

profile.php in ExtCalendar 2 and earlier allows remote attackers to change the passwords of arbitrary users without providing the original password, and possibly perform other unauthorized actions, via modified values to register.php.

CVSS Score

9.8

CRITICAL

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality
HIGH
Integrity
HIGH
Availability
HIGH

Affected Products

VendorProductVersions
Extcalendar ProjectExtcalendar<= 2

Related Weaknesses (CWE)

CWE-522

References

FAQ

What is CVE-2007-0681?

CVE-2007-0681 is a vulnerability with a CVSS score of 9.8 (CRITICAL). profile.php in ExtCalendar 2 and earlier allows remote attackers to change the passwords of arbitrary users without providing the original password, and possibly perform other unauthorized actions, vi...

How severe is CVE-2007-0681?

CVE-2007-0681 has been rated CRITICAL with a CVSS base score of 9.8/10. This is considered a critical vulnerability requiring immediate attention.

Is there a patch for CVE-2007-0681?

Check the references section above for vendor advisories and patch information. Affected products include: Extcalendar Project Extcalendar.