CVE-2007-2441 json
Caucho Resin Professional 3.1.0 and Caucho Resin 3.1.0 and earlier for Windows allows remote attackers to obtain the system path via certai…
published 2007-05-16 19 y ago modified 2026-06-16 4 mo ago also EUVD-2007-2436
- cvss
- 5.0
- version 2.0, NVD
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 3.3%
- EPSS 3.3% chance of exploitation in 30 days, percentile 88%
- public exploits
- 1
- Exploit-DB
Summary
Caucho Resin Professional 3.1.0 and Caucho Resin 3.1.0 and earlier for Windows allows remote attackers to obtain the system path via certain URLs associated with (1) deploying web applications or (2) displaying .xtp files.
Patch / fix
Timeline
- First public exploit (EDB-30037)
- Published
Exploit prediction
3.27% chance of exploitation in the next 30 days, higher than 88% of all scored CVEs (FIRST EPSS, 2026-11-08).
Exploits and checks
- EDB-30037 Caucho Resin 3.1 - Encoded Space Request Full Path Disclosure remote, 2007-05-15
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| NVD | 2.0 | 5.0 | AV:N/AC:L/Au:N/C:P/I:N/A:N |
References
-
securitytracker.com
/id?1018061
vdb-entry, patch
-
rapid7.com
/advisories/R7-0030.jsp
patch
-
secunia.com
/advisories/25286
third-party-advisory, patch, vendor-advisory
-
caucho.com
/resin-3.1/changes/changes.xtp
patch
-
exchange.xforce.ibmcloud.com
/vulnerabilities/34293
vdb-entry
-
vupen.com
/english/advisories/2007/1824
vdb-entry
-
securityfocus.com
/bid/23985
vdb-entry
-
osvdb.org
/36057
vdb-entry
Sources
- CVE List CVE-2007-2441
- NVD CVE-2007-2441
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.