CVE-2007-5578 - Vulnerability Details - OpenCVE

Basic Analysis and Security Engine (BASE) before 1.3.8 sends a redirect to the web browser but does not exit, which allows remote attackers to bypass authentication via (1) base_main.php, (2) base_qry_alert.php, and possibly other vectors.

No CVSS v4.0

No CVSS v3.1

No CVSS v3.0

Access Vector Network

Access Complexity Low

Authentication None

Confidentiality Impact Partial

Integrity Impact Partial

Availability Impact Partial

This CVE is not in the KEV list.

Key SSVC decision points have not yet been added.

Vendors	Products
Secureideas	Basic Analysis And Security Engine

Configuration 1 [-]

cpe:2.3:a:secureideas:basic_analysis_and_security_engine:1.3.6:*:*:*:*:*:*:*

No data.

References

Link	Providers
http://archives.neohapsis.com/archives/fulldisclosure/2007-06/0031.html
http://lists.grok.org.uk/pipermail/full-disclosure/2007-June/063767.html
http://secunia.com/advisories/25518
http://sourceforge.net/project/shownotes.php?group_id=103348&release_id=521723
http://www.osvdb.org/35243
http://www.securityfocus.com/bid/24315
https://exchange.xforce.ibmcloud.com/vulnerabilities/34724

History

No history.

MITRE

Status: PUBLISHED

Assigner: mitre

Published: 2007-10-18T22:00:00

Updated: 2024-08-07T15:39:13.297Z

Reserved: 2007-10-18T00:00:00

Link: CVE-2007-5578

Vulnrichment

No data.

NVD

Status : Deferred

Published: 2007-10-18T22:17:00.000

Modified: 2025-04-09T00:30:58.490

Link: CVE-2007-5578

Redhat

No data.

{"containers": {"cna": {"affected": [{"product": "n/a", "vendor": "n/a", "versions": [{"status": "affected", "version": "n/a"}]}], "datePublic": "2007-06-04T00:00:00", "descriptions": [{"lang": "en", "value": "Basic Analysis and Security Engine (BASE) before 1.3.8 sends a redirect to the web browser but does not exit, which allows remote attackers to bypass authentication via (1) base_main.php, (2) base_qry_alert.php, and possibly other vectors."}], "problemTypes": [{"descriptions": [{"description": "n/a", "lang": "en", "type": "text"}]}], "providerMetadata": {"dateUpdated": "2017-07-28T12:57:01", "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "shortName": "mitre"}, "references": [{"name": "24315", "tags": ["vdb-entry", "x_refsource_BID"], "url": "http://www.securityfocus.com/bid/24315"}, {"name": "20070606 Kevin Johnson BASE <= 1.3.6 authentication bypass", "tags": ["mailing-list", "x_refsource_FULLDISC"], "url": "http://lists.grok.org.uk/pipermail/full-disclosure/2007-June/063767.html"}, {"name": "20070604 Kevin Johnson BASE <= 1.3.6 authentication bypass", "tags": ["mailing-list", "x_refsource_FULLDISC"], "url": "http://archives.neohapsis.com/archives/fulldisclosure/2007-06/0031.html"}, {"name": "25518", "tags": ["third-party-advisory", "x_refsource_SECUNIA"], "url": "http://secunia.com/advisories/25518"}, {"name": "35243", "tags": ["vdb-entry", "x_refsource_OSVDB"], "url": "http://www.osvdb.org/35243"}, {"name": "base-basemain-security-bypass(34724)", "tags": ["vdb-entry", "x_refsource_XF"], "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/34724"}, {"tags": ["x_refsource_CONFIRM"], "url": "http://sourceforge.net/project/shownotes.php?group_id=103348&release_id=521723"}], "x_legacyV4Record": {"CVE_data_meta": {"ASSIGNER": "cve@mitre.org", "ID": "CVE-2007-5578", "STATE": "PUBLIC"}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"product_name": "n/a", "version": {"version_data": [{"version_value": "n/a"}]}}]}, "vendor_name": "n/a"}]}}, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": {"description_data": [{"lang": "eng", "value": "Basic Analysis and Security Engine (BASE) before 1.3.8 sends a redirect to the web browser but does not exit, which allows remote attackers to bypass authentication via (1) base_main.php, (2) base_qry_alert.php, and possibly other vectors."}]}, "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "n/a"}]}]}, "references": {"reference_data": [{"name": "24315", "refsource": "BID", "url": "http://www.securityfocus.com/bid/24315"}, {"name": "20070606 Kevin Johnson BASE <= 1.3.6 authentication bypass", "refsource": "FULLDISC", "url": "http://lists.grok.org.uk/pipermail/full-disclosure/2007-June/063767.html"}, {"name": "20070604 Kevin Johnson BASE <= 1.3.6 authentication bypass", "refsource": "FULLDISC", "url": "http://archives.neohapsis.com/archives/fulldisclosure/2007-06/0031.html"}, {"name": "25518", "refsource": "SECUNIA", "url": "http://secunia.com/advisories/25518"}, {"name": "35243", "refsource": "OSVDB", "url": "http://www.osvdb.org/35243"}, {"name": "base-basemain-security-bypass(34724)", "refsource": "XF", "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/34724"}, {"name": "http://sourceforge.net/project/shownotes.php?group_id=103348&release_id=521723", "refsource": "CONFIRM", "url": "http://sourceforge.net/project/shownotes.php?group_id=103348&release_id=521723"}]}}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-07T15:39:13.297Z"}, "title": "CVE Program Container", "references": [{"name": "24315", "tags": ["vdb-entry", "x_refsource_BID", "x_transferred"], "url": "http://www.securityfocus.com/bid/24315"}, {"name": "20070606 Kevin Johnson BASE <= 1.3.6 authentication bypass", "tags": ["mailing-list", "x_refsource_FULLDISC", "x_transferred"], "url": "http://lists.grok.org.uk/pipermail/full-disclosure/2007-June/063767.html"}, {"name": "20070604 Kevin Johnson BASE <= 1.3.6 authentication bypass", "tags": ["mailing-list", "x_refsource_FULLDISC", "x_transferred"], "url": "http://archives.neohapsis.com/archives/fulldisclosure/2007-06/0031.html"}, {"name": "25518", "tags": ["third-party-advisory", "x_refsource_SECUNIA", "x_transferred"], "url": "http://secunia.com/advisories/25518"}, {"name": "35243", "tags": ["vdb-entry", "x_refsource_OSVDB", "x_transferred"], "url": "http://www.osvdb.org/35243"}, {"name": "base-basemain-security-bypass(34724)", "tags": ["vdb-entry", "x_refsource_XF", "x_transferred"], "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/34724"}, {"tags": ["x_refsource_CONFIRM", "x_transferred"], "url": "http://sourceforge.net/project/shownotes.php?group_id=103348&release_id=521723"}]}]}, "cveMetadata": {"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "assignerShortName": "mitre", "cveId": "CVE-2007-5578", "datePublished": "2007-10-18T22:00:00", "dateReserved": "2007-10-18T00:00:00", "dateUpdated": "2024-08-07T15:39:13.297Z", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.1"}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:secureideas:basic_analysis_and_security_engine:1.3.6:*:*:*:*:*:*:*", "matchCriteriaId": "B1871740-5E57-4E16-AFDF-8B3456A38FE8", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Basic Analysis and Security Engine (BASE) before 1.3.8 sends a redirect to the web browser but does not exit, which allows remote attackers to bypass authentication via (1) base_main.php, (2) base_qry_alert.php, and possibly other vectors."}, {"lang": "es", "value": "Basic Analysis y Security Engine (BASE) anterior a 1.3.8 env\u00eda una redirecci\u00f3n al navegador web pero no finaliza, lo cual permite a atacantes remotos evitar la autenticaci\u00f3n mediante (1) base_main.php, (2) base_qry_alert.php, y posiblemente otros vectores."}], "id": "CVE-2007-5578", "lastModified": "2025-04-09T00:30:58.490", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "HIGH", "cvssData": {"accessComplexity": "LOW", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "PARTIAL", "baseScore": 7.5, "confidentialityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P", "version": "2.0"}, "exploitabilityScore": 10.0, "impactScore": 6.4, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": true, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": true}]}, "published": "2007-10-18T22:17:00.000", "references": [{"source": "cve@mitre.org", "url": "http://archives.neohapsis.com/archives/fulldisclosure/2007-06/0031.html"}, {"source": "cve@mitre.org", "url": "http://lists.grok.org.uk/pipermail/full-disclosure/2007-June/063767.html"}, {"source": "cve@mitre.org", "tags": ["Patch", "Vendor Advisory"], "url": "http://secunia.com/advisories/25518"}, {"source": "cve@mitre.org", "tags": ["Patch"], "url": "http://sourceforge.net/project/shownotes.php?group_id=103348&release_id=521723"}, {"source": "cve@mitre.org", "url": "http://www.osvdb.org/35243"}, {"source": "cve@mitre.org", "url": "http://www.securityfocus.com/bid/24315"}, {"source": "cve@mitre.org", "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/34724"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://archives.neohapsis.com/archives/fulldisclosure/2007-06/0031.html"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://lists.grok.org.uk/pipermail/full-disclosure/2007-June/063767.html"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Patch", "Vendor Advisory"], "url": "http://secunia.com/advisories/25518"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Patch"], "url": "http://sourceforge.net/project/shownotes.php?group_id=103348&release_id=521723"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://www.osvdb.org/35243"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://www.securityfocus.com/bid/24315"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/34724"}], "sourceIdentifier": "cve@mitre.org", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-287"}], "source": "nvd@nist.gov", "type": "Primary"}]}