{
  "id": "CVE-2007-3572",
  "sourceIdentifier": "cve@mitre.org",
  "published": "2007-07-05T20:30:00.000",
  "lastModified": "2017-07-29T01:32:22.940",
  "vulnStatus": "Modified",
  "evaluatorSolution": "The vendor has addressed this issue through the release of the following product update: http://www.yoggie.com/supportcase.asp \r\n",
  "descriptions": [
    {
      "lang": "en",
      "value": "Incomplete blacklist vulnerability in cgi-bin/runDiagnostics.cgi in the web interface on the Yoggie Pico and Pico Pro allows remote attackers to execute arbitrary commands via shell metacharacters in the param parameter, as demonstrated by URL encoded \"`\" (backtick) characters (%60 sequences)."
    },
    {
      "lang": "es",
      "value": "Vulnerabilidad de lista negra incompleta en cgi-bin/runDIagnostics.cgi en la interfaz web de Yoggie Pico y Pico Pro permite a atacantes remotos ejecutar comandos de su elecci\u00f3n mediante metacaracteres de l\u00ednea de comandos en el par\u00e1metro param, como se ha demostrado con caracteres \"`\" (tilde invertida) codificados en formato URL (secuencias %60)."
    }
  ],
  "metrics": {
    "cvssMetricV2": [
      {
        "source": "nvd@nist.gov",
        "type": "Primary",
        "cvssData": {
          "version": "2.0",
          "vectorString": "AV:N/AC:M/Au:N/C:C/I:C/A:C",
          "accessVector": "NETWORK",
          "accessComplexity": "MEDIUM",
          "authentication": "NONE",
          "confidentialityImpact": "COMPLETE",
          "integrityImpact": "COMPLETE",
          "availabilityImpact": "COMPLETE",
          "baseScore": 9.3
        },
        "baseSeverity": "HIGH",
        "exploitabilityScore": 8.6,
        "impactScore": 10.0,
        "acInsufInfo": false,
        "obtainAllPrivilege": true,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": true
      }
    ]
  },
  "weaknesses": [
    {
      "source": "nvd@nist.gov",
      "type": "Primary",
      "description": [
        {
          "lang": "en",
          "value": "NVD-CWE-Other"
        }
      ]
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "operator": "OR",
          "negate": false,
          "cpeMatch": [
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:yoggie:pico:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "537FAB08-D943-4C94-B6B2-7634CE212DD6"
            },
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:yoggie:pico_pro:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "0192D1AF-43BB-4F9E-9F0E-E812DCAE5512"
            }
          ]
        }
      ]
    }
  ],
  "references": [
    {
      "url": "http://archives.neohapsis.com/archives/fulldisclosure/2007-07/0020.html",
      "source": "cve@mitre.org",
      "tags": [
        "Exploit"
      ]
    },
    {
      "url": "http://archives.neohapsis.com/archives/fulldisclosure/2007-07/0092.html",
      "source": "cve@mitre.org"
    },
    {
      "url": "http://www.securityfocus.com/bid/24743",
      "source": "cve@mitre.org",
      "tags": [
        "Exploit"
      ]
    },
    {
      "url": "http://www.vupen.com/english/advisories/2007/2417",
      "source": "cve@mitre.org"
    },
    {
      "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/35208",
      "source": "cve@mitre.org"
    }
  ]
}