CVE-2007-6314

Published: Dec 12, 2007Modified: Apr 23, 2026

5.0

Vector

AV:N/AC:L/Au:N/C:N/I:P/A:N

Exploitability: 10.0 / Impact: 2.9

Source: NVD

Description

BarracudaDrive Web Server before 3.8 allows remote attackers to read the source code for web scripts by appending a (1) + (plus), (2) . (dot), or (3) %80 and similar characters to the file name in the URL.

Affected (2)

Products: Real Time Logic: Barracudadrive Web Server, Barracudadrive Web Server Home Server

Real Time Logic

2 products

Barracudadrive Web Server

Barracudadrive Web Server Home Server

Configuration A

2 vulnerable

Vulnerable Software	Affected Versions
Real Time Logic Barracudadrive Web Server	Version 3.7.2
Real Time Logic Barracudadrive Web Server Home Server	Version 3.7.2

Related CWEs

CWE-20

Improper Input Validation

The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.

References (12)

http://aluigi.altervista.org/adv/barradrive-adv.txt

Source: cve@mitre.org

Exploit

http://secunia.com/advisories/28032

Source: cve@mitre.org

Vendor Advisory

http://securityreason.com/securityalert/3434

Source: cve@mitre.org

http://www.securityfocus.com/archive/1/484833/100/0/threaded

Source: cve@mitre.org

http://www.securityfocus.com/bid/26805

Source: cve@mitre.org

ExploitPatch

https://exchange.xforce.ibmcloud.com/vulnerabilities/38972

Source: cve@mitre.org

http://aluigi.altervista.org/adv/barradrive-adv.txt