CVE-2007-2233

Published: Apr 25, 2007Modified: Apr 23, 2026

6.5

Vector

AV:N/AC:L/Au:S/C:P/I:P/A:P

Exploitability: 8.0 / Impact: 6.4

Source: NVD

Description

cosign-bin/cosign.cgi in Cosign 2.0.2 and earlier allows remote authenticated users to perform unauthorized actions as an arbitrary user by using CR (\r) sequences in the service parameter to inject LOGIN and REGISTER commands with the desired username.

Affected (13)

Products: Cosign: Cosign

Cosign

1 product

Cosign

Configuration A

13 vulnerable

Vulnerable Software	Affected Versions
Cosign Cosign	Version 0.7.0
Cosign Cosign	Version 0.8.0
Cosign Cosign	Version 0.9.0
Cosign Cosign	Version 1.0
Cosign Cosign	Version 1.1
Cosign Cosign	Version 1.5
Cosign Cosign	Version 1.6
Cosign Cosign	Version 1.7
Cosign Cosign	Version 1.8.5
Cosign Cosign	Version 1.8
Cosign Cosign	Version 1.9
Cosign Cosign	Version 2.0.1
Cosign Cosign	Version 2.0.2