CVE-2005-3330
published 2005-10-27CVE-2005-3330: The _httpsrequest function in Snoopy 1.2, as used in products such as (1) MagpieRSS, (2) WordPress, (3) Ampache, and (4) Jinzora, allows remote attackers to…
PriorityP351high7.5CVSS 2.0
AVNACLAuNCPIPAP
EXPLOIT
EPSS
17.19%
96.7th percentile
The _httpsrequest function in Snoopy 1.2, as used in products such as (1) MagpieRSS, (2) WordPress, (3) Ampache, and (4) Jinzora, allows remote attackers to execute arbitrary commands via shell metacharacters in an HTTPS URL to an SSL protected web page, which is not properly handled by the fetch function.
Affected
2 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | wordpress | — | — |
| snoopy | snoopy | — | — |
CVSS provenance
nvdv2.07.5HIGHAV:N/AC:L/Au:N/C:P/I:P/A:P
vendor_debian7.5LOW
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Debian
CVE-2005-3330: wordpress - The _httpsrequest function in Snoopy 1.2, as used in products such as (1) Magpie...
vendor_debian·2005·CVSS 7.5
CVE-2005-3330 [HIGH] CVE-2005-3330: wordpress - The _httpsrequest function in Snoopy 1.2, as used in products such as (1) Magpie...
The _httpsrequest function in Snoopy 1.2, as used in products such as (1) MagpieRSS, (2) WordPress, (3) Ampache, and (4) Jinzora, allows remote attackers to execute arbitrary commands via shell metacharacters in an HTTPS URL to an SSL protected web page, which is not properly handled by the fetch function.
Scope: local
bookworm: resolved
bullseye: resolved
forky: resolved
sid: resolved
trixie: resolved
GHSA
GHSA-hf3f-2785-5v5g: The _httpsrequest function in Snoopy 1
ghsa_unreviewed·2022-05-01
CVE-2005-3330 [HIGH] CWE-20 GHSA-hf3f-2785-5v5g: The _httpsrequest function in Snoopy 1
The _httpsrequest function in Snoopy 1.2, as used in products such as (1) MagpieRSS, (2) WordPress, (3) Ampache, and (4) Jinzora, allows remote attackers to execute arbitrary commands via shell metacharacters in an HTTPS URL to an SSL protected web page, which is not properly handled by the fetch function.
No detection rules found.
http://marc.info/?l=bugtraq&m=113028858316430&w=2http://marc.info/?l=bugtraq&m=113062897231412&w=2http://secunia.com/advisories/17330http://secunia.com/advisories/17455http://secunia.com/advisories/17779http://secunia.com/advisories/17887http://securityreason.com/securityalert/117http://securitytracker.com/id?1015104http://sourceforge.net/project/shownotes.php?release_id=368750http://sourceforge.net/project/shownotes.php?release_id=375385http://www.osvdb.org/20316http://www.securityfocus.com/bid/15213http://www.vupen.com/english/advisories/2005/2202http://www.vupen.com/english/advisories/2005/2335http://www.vupen.com/english/advisories/2005/2727https://exchange.xforce.ibmcloud.com/vulnerabilities/22874https://svn.ampache.org/branches/3.3.1/docs/CHANGELOGhttp://marc.info/?l=bugtraq&m=113028858316430&w=2http://marc.info/?l=bugtraq&m=113062897231412&w=2http://secunia.com/advisories/17330http://secunia.com/advisories/17455http://secunia.com/advisories/17779http://secunia.com/advisories/17887http://securityreason.com/securityalert/117http://securitytracker.com/id?1015104http://sourceforge.net/project/shownotes.php?release_id=368750http://sourceforge.net/project/shownotes.php?release_id=375385http://www.osvdb.org/20316http://www.securityfocus.com/bid/15213http://www.vupen.com/english/advisories/2005/2202http://www.vupen.com/english/advisories/2005/2335http://www.vupen.com/english/advisories/2005/2727https://exchange.xforce.ibmcloud.com/vulnerabilities/22874https://svn.ampache.org/branches/3.3.1/docs/CHANGELOG
2005-10-27
Published