| CVE-2007-6405 | Date: (C)2007-12-17 (M)2023-12-22 |
Sergey Lyubka Simple HTTPD (shttpd) 1.38 and earlier on Windows allows remote attackers to download arbitrary CGI programs or scripts via a URI with an appended (1) '+' character, (2) '.' character, (3) %2e sequence (hex-encoded dot), or (4) hex-encoded character greater than 0x7f. NOTE: the %20 vector is already covered by CVE-2007-3407.
CVSS Score and Metrics +CVSS Score and Metrics -| CVSS V2 Severity: |
| CVSS Score : 6.4 |
| Exploit Score: 10.0 |
| Impact Score: 4.9 |
| |
| CVSS V2 Metrics: |
| Access Vector: NETWORK |
| Access Complexity: LOW |
| Authentication: NONE |
| Confidentiality: PARTIAL |
| Integrity: PARTIAL |
| Availability: NONE |
| | |
