CVE-2007-5463 json
ideal_process.php in the iDEAL payment module in ViArt Shop 3.3 beta and earlier might allow remote attackers to obtain the pathname for ce…
published 2007-10-15 19 y ago modified 2026-06-16 4 mo ago also EUVD-2007-5438
- cvss
- 5.0
- version 2.0, NVD
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 1.0%
- EPSS 1.0% chance of exploitation in 30 days, percentile 62%
- public exploits
- 0
- none known
Summary
ideal_process.php in the iDEAL payment module in ViArt Shop 3.3 beta and earlier might allow remote attackers to obtain the pathname for certificate and key files via an "iDEAL transaction", possibly involving fopen error messages for nonexistent files, a different issue than CVE-2007-5364. NOTE: this can be leveraged for reading certificate or key files if an installation places these files under the web document root.
Patch / fix
Exploit prediction
0.98% chance of exploitation in the next 30 days, higher than 62% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| NVD | 2.0 | 5.0 | AV:N/AC:L/Au:N/C:P/I:N/A:N |
Classification
- Weakness
-
- CWE-22 Improper Limitation of a Pathname to a Restricted Directory
References
-
viart.com
/ideal_process_script_fix_for_release_32_and_33_beta.html
patch
-
secunia.com
/advisories/27199
third-party-advisory, patch, vendor-advisory
-
securityreason.com
/securityalert/3233
third-party-advisory
-
securityfocus.com
/archive/1/481978/100/0/threaded
mailing-list
-
osvdb.org
/40151
vdb-entry
-
securityfocus.com
/bid/25998
vdb-entry
-
exchange.xforce.ibmcloud.com
/vulnerabilities/37048
vdb-entry
Sources
- CVE List CVE-2007-5463
- NVD CVE-2007-5463
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.