CVE-2013-7034
high
CVSS v3
—
CVSS v2
7.5
VIR risk
7.5
Description
The setCookieValue function in _lib/functions.global.inc.php in LiveZilla before 5.1.2.1 allows remote attackers to execute arbitrary PHP code via a serialized PHP object in a cookie.
Predictions
Exploit likelihood
20%
Patch ETA
—
Heuristic predictions, AS-IS, for prioritization only.
Mitigations
No vendor mitigations ingested yet for this CVE. The mitigation-content worker queues fetches as references arrive — check back in a few minutes, or see the references list below.
Application impact
| Vendor | Product | Versions | Fixed |
|---|---|---|---|
| livezilla | livezilla | {"endIncluding":"5.1.2.0"} | |
| livezilla | livezilla | 3.1.8.3 | |
| livezilla | livezilla | 3.2.0.2 | |
| livezilla | livezilla | 4.0.1.0 | |
| livezilla | livezilla | 4.0.1.1 | |
| livezilla | livezilla | 4.0.1.2 | |
| livezilla | livezilla | 4.1.0.3 | |
| livezilla | livezilla | 4.1.0.4 | |
| livezilla | livezilla | 4.2.0.4 | |
| livezilla | livezilla | 4.2.0.5 | |
| livezilla | livezilla | 5.0.1.0 | |
| livezilla | livezilla | 5.0.1.1 | |
| livezilla | livezilla | 5.0.1.2 | |
| livezilla | livezilla | 5.0.1.3 | |
| livezilla | livezilla | 5.0.1.4 | |
| livezilla | livezilla | 5.1.0.0 | |
| livezilla | livezilla | 5.1.1.0 | |
References
- http://archives.neohapsis.com/archives/bugtraq/2013-12/0078.html
- http://forums.livezilla.net/index.php?/topic/163-livezilla-changelog/
- http://www.securityfocus.com/bid/64383
- https://exchange.xforce.ibmcloud.com/vulnerabilities/89796
- http://archives.neohapsis.com/archives/bugtraq/2013-12/0078.html
- http://forums.livezilla.net/index.php?/topic/163-livezilla-changelog/
- http://www.securityfocus.com/bid/64383
- https://exchange.xforce.ibmcloud.com/vulnerabilities/89796
CWEs
CWE-94
Verify integrity in audit chain (admin only). AS-IS.