CVE Feed

    Dashboard / CVE / CVE-2007-0187

    CVE-2007-0187

    F5 FirePass 5.4 through 5.5.2 and 6.0 allows remote attackers to access restricted URLs via (1) a trailing null byte, (2) multiple leading slashes, (3) Unicode encoding, (4) URL-encoded directory traversal or same-directory characters, or (5) upper case letters in the domain name.

    Published:Jan 11, 2007
    Last Modified:Apr 23, 2026
    EPS:Jan 11, 2007
    EPSS Score:0.01232
    CVSS Score:7.5

    Affected Products

    Vendor
    F5
    Product
    Firepass

    Exploits

    No exploit reference

    Common Weakness Enumeration

    No CWE recorded yet

    Common Attack Pattern Enumeration and Classification (CAPEC)

    No CAPEC recorded yet

    Related CVEs

    CVE-2014-2927 (CVSS 9.3) — The rsync daemon in F5 BIG-IP 11.6 before 11.6.0, 11.5.1 before HF3, 11.5.0 before HF4, 11.4.1 before HF4, 11.…
    CVE-2013-6024 (CVSS 4.4) — The Edge Client components in F5 BIG-IP APM 10.x, 11.x, 12.x, 13.x, and 14.x, BIG-IP Edge Gateway 10.x and 11.…
    CVE-2013-0150 (CVSS 9.3) — Directory traversal vulnerability in an unspecified signed Java applet in the client-side components in F5 BIG…
    CVE-2013-3587 (CVSS 5.9) — The HTTPS protocol, as used in unspecified web applications, can encrypt compressed data without properly obfu…
    CVE-2012-1777 (CVSS 7.5) — SQL injection vulnerability in my.activation.php3 in F5 FirePass 6.0.0 through 6.1.0 and 7.0.0 allows remote a…
    CVE-2012-2053 (CVSS 7.2) — The sudoers file in the Linux system configuration in F5 FirePass 6.0.0 through 6.1.0 and 7.0.0 does not requi…
    CVE-2011-3188 (CVSS 9.1) — The (1) IPv4 and (2) IPv6 implementations in the Linux kernel before 3.1 use a modified MD4 algorithm to gener…
    CVE-2007-0188 (CVSS 6.5) — F5 FirePass 5.4 through 5.5.1 does not properly enforce host access restrictions when a client uses a single i…
    CVE-2007-0195 (CVSS 5) — my.activation.php3 in F5 FirePass 5.4 through 5.5.1 and 6.0 displays different error messages for failed login…

    References

    http://archives.neohapsis.com/archives/fulldisclosure/2007-01/0141.html
    http://lists.grok.org.uk/pipermail/full-disclosure/2007-January/051651.html
    http://osvdb.org/39167
    http://secunia.com/advisories/23626
    http://secunia.com/advisories/23640
    http://www.mnin.org/advisories/2007_firepass.pdf
    http://www.securityfocus.com/bid/21957
    https://tech.f5.com/home/solutions/sol6916.html
    https://tech.f5.com/home/solutions/sol6924.html
    http://archives.neohapsis.com/archives/fulldisclosure/2007-01/0141.html
    http://lists.grok.org.uk/pipermail/full-disclosure/2007-January/051651.html
    http://osvdb.org/39167
    http://secunia.com/advisories/23626
    http://secunia.com/advisories/23640
    http://www.mnin.org/advisories/2007_firepass.pdf
    http://www.securityfocus.com/bid/21957
    https://tech.f5.com/home/solutions/sol6916.html
    https://tech.f5.com/home/solutions/sol6924.html

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High