{"api_version":"1","generated_at":"2026-07-23T07:31:05+00:00","cve":"CVE-2007-1035","urls":{"html":"https://cve.report/CVE-2007-1035","api":"https://cve.report/api/cve/CVE-2007-1035.json","docs":"https://cve.report/api","cve_org":"https://www.cve.org/CVERecord?id=CVE-2007-1035","nvd":"https://nvd.nist.gov/vuln/detail/CVE-2007-1035"},"summary":{"title":"CVE-2007-1035","description":"Unspecified vulnerability in certain demonstration scripts in getID3 1.7.1, as used in the Mediafield and Audio modules for Drupal, allows remote attackers to read and delete arbitrary files, list arbitrary directories, and write to empty files or .mp3 files via unknown vectors.","state":"PUBLISHED","assigner":"mitre","published_at":"2007-02-21 11:28:00","updated_at":"2026-04-23 00:35:47"},"problem_types":["NVD-CWE-Other","n/a"],"metrics":[{"version":"2.0","source":"nvd@nist.gov","type":"Primary","score":"7.5","severity":"","vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","data":{"version":"2.0","vectorString":"AV:N/AC:L/Au:N/C:P/I:P/A:P","baseScore":7.5,"accessVector":"NETWORK","accessComplexity":"LOW","authentication":"NONE","confidentialityImpact":"PARTIAL","integrityImpact":"PARTIAL","availabilityImpact":"PARTIAL"}}],"references":[{"url":"http://drupal.org/node/119385","name":"http://drupal.org/node/119385","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Patch","Vendor Advisory"],"title":"getID3 library and Audio, Mediafield - arbitrary code execution | drupal.org","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://www.vupen.com/english/advisories/2007/0635","name":"http://www.vupen.com/english/advisories/2007/0635","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"Webmail : Solution de messagerie professionnelle - OVHcloud- OVH","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://blamcast.net/articles/highly-critical-security-flaws-in-drupal-audio-module","name":"http://blamcast.net/articles/highly-critical-security-flaws-in-drupal-audio-module","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"Highly Critical Security Flaws In Drupal Audio Module","mime":"text/html","httpstatus":"404","archivestatus":"200"},{"url":"http://www.securityfocus.com/bid/22587","name":"http://www.securityfocus.com/bid/22587","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Patch"],"title":"Drupal Audio And MediaField Modules GetID3 Remote Command Execution Vulnerability","mime":"text/html","httpstatus":"200","archivestatus":"0"},{"url":"http://osvdb.org/35161","name":"http://osvdb.org/35161","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"","mime":"","httpstatus":"-1","archivestatus":"0"},{"url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/32542","name":"https://exchange.xforce.ibmcloud.com/vulnerabilities/32542","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"IBM X-Force Exchange","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"https://www.cve.org/CVERecord?id=CVE-2007-1035","name":"CVE Program record","refsource":"CVE.ORG","tags":["canonical"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2007-1035","name":"NVD vulnerability detail","refsource":"NVD","tags":["canonical","analysis"]}],"affected":[{"source":"CNA","vendor":"n/a","product":"n/a","version":"affected n/a","platforms":[]}],"timeline":[],"solutions":[],"workarounds":[],"exploits":[],"credits":[],"nvd_cpes":[{"cve_year":"2007","cve_id":"1035","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"drupal","cpe5":"audio_module","cpe6":"*","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2007","cve_id":"1035","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"drupal","cpe5":"getid3","cpe6":"1.7.1","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2007","cve_id":"1035","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"drupal","cpe5":"mediafield_module","cpe6":"*","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"}],"vendor_comments":[],"enrichments":{"kev":null,"epss":null,"legacy_qids":[]},"source_records":{"cve_program":{"containers":{"adp":[{"providerMetadata":{"dateUpdated":"2024-08-07T12:43:22.597Z","orgId":"af854a3a-2127-422b-91ae-364da2661108","shortName":"CVE"},"references":[{"name":"drupal-getid3-code-execution(32542)","tags":["vdb-entry","x_refsource_XF","x_transferred"],"url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/32542"},{"name":"ADV-2007-0635","tags":["vdb-entry","x_refsource_VUPEN","x_transferred"],"url":"http://www.vupen.com/english/advisories/2007/0635"},{"name":"22587","tags":["vdb-entry","x_refsource_BID","x_transferred"],"url":"http://www.securityfocus.com/bid/22587"},{"tags":["x_refsource_CONFIRM","x_transferred"],"url":"http://drupal.org/node/119385"},{"tags":["x_refsource_MISC","x_transferred"],"url":"http://blamcast.net/articles/highly-critical-security-flaws-in-drupal-audio-module"},{"name":"35161","tags":["vdb-entry","x_refsource_OSVDB","x_transferred"],"url":"http://osvdb.org/35161"}],"title":"CVE Program Container"}],"cna":{"affected":[{"product":"n/a","vendor":"n/a","versions":[{"status":"affected","version":"n/a"}]}],"datePublic":"2007-02-16T00:00:00.000Z","descriptions":[{"lang":"en","value":"Unspecified vulnerability in certain demonstration scripts in getID3 1.7.1, as used in the Mediafield and Audio modules for Drupal, allows remote attackers to read and delete arbitrary files, list arbitrary directories, and write to empty files or .mp3 files via unknown vectors."}],"problemTypes":[{"descriptions":[{"description":"n/a","lang":"en","type":"text"}]}],"providerMetadata":{"dateUpdated":"2017-07-28T12:57:01.000Z","orgId":"8254265b-2729-46b6-b9e3-3dfca2d5bfca","shortName":"mitre"},"references":[{"name":"drupal-getid3-code-execution(32542)","tags":["vdb-entry","x_refsource_XF"],"url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/32542"},{"name":"ADV-2007-0635","tags":["vdb-entry","x_refsource_VUPEN"],"url":"http://www.vupen.com/english/advisories/2007/0635"},{"name":"22587","tags":["vdb-entry","x_refsource_BID"],"url":"http://www.securityfocus.com/bid/22587"},{"tags":["x_refsource_CONFIRM"],"url":"http://drupal.org/node/119385"},{"tags":["x_refsource_MISC"],"url":"http://blamcast.net/articles/highly-critical-security-flaws-in-drupal-audio-module"},{"name":"35161","tags":["vdb-entry","x_refsource_OSVDB"],"url":"http://osvdb.org/35161"}],"x_legacyV4Record":{"CVE_data_meta":{"ASSIGNER":"cve@mitre.org","ID":"CVE-2007-1035","STATE":"PUBLIC"},"affects":{"vendor":{"vendor_data":[{"product":{"product_data":[{"product_name":"n/a","version":{"version_data":[{"version_value":"n/a"}]}}]},"vendor_name":"n/a"}]}},"data_format":"MITRE","data_type":"CVE","data_version":"4.0","description":{"description_data":[{"lang":"eng","value":"Unspecified vulnerability in certain demonstration scripts in getID3 1.7.1, as used in the Mediafield and Audio modules for Drupal, allows remote attackers to read and delete arbitrary files, list arbitrary directories, and write to empty files or .mp3 files via unknown vectors."}]},"problemtype":{"problemtype_data":[{"description":[{"lang":"eng","value":"n/a"}]}]},"references":{"reference_data":[{"name":"drupal-getid3-code-execution(32542)","refsource":"XF","url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/32542"},{"name":"ADV-2007-0635","refsource":"VUPEN","url":"http://www.vupen.com/english/advisories/2007/0635"},{"name":"22587","refsource":"BID","url":"http://www.securityfocus.com/bid/22587"},{"name":"http://drupal.org/node/119385","refsource":"CONFIRM","url":"http://drupal.org/node/119385"},{"name":"http://blamcast.net/articles/highly-critical-security-flaws-in-drupal-audio-module","refsource":"MISC","url":"http://blamcast.net/articles/highly-critical-security-flaws-in-drupal-audio-module"},{"name":"35161","refsource":"OSVDB","url":"http://osvdb.org/35161"}]}}}},"cveMetadata":{"assignerOrgId":"8254265b-2729-46b6-b9e3-3dfca2d5bfca","assignerShortName":"mitre","cveId":"CVE-2007-1035","datePublished":"2007-02-21T11:00:00.000Z","dateReserved":"2007-02-20T00:00:00.000Z","dateUpdated":"2024-08-07T12:43:22.597Z","state":"PUBLISHED"},"dataType":"CVE_RECORD","dataVersion":"5.1"},"nvd":{"publishedDate":"2007-02-21 11:28:00","lastModifiedDate":"2026-04-23 00:35:47","problem_types":["NVD-CWE-Other","n/a"],"metrics":{"cvssMetricV2":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"2.0","vectorString":"AV:N/AC:L/Au:N/C:P/I:P/A:P","baseScore":7.5,"accessVector":"NETWORK","accessComplexity":"LOW","authentication":"NONE","confidentialityImpact":"PARTIAL","integrityImpact":"PARTIAL","availabilityImpact":"PARTIAL"},"baseSeverity":"HIGH","exploitabilityScore":10,"impactScore":6.4,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":true,"userInteractionRequired":false}]},"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:drupal:audio_module:*:*:*:*:*:*:*:*","matchCriteriaId":"5816F7EC-3A40-4EAE-8BA6-08483ED078D9"},{"vulnerable":true,"criteria":"cpe:2.3:a:drupal:getid3:1.7.1:*:*:*:*:*:*:*","matchCriteriaId":"099698D4-A001-4D2C-92E5-E0F00EC71FF2"},{"vulnerable":true,"criteria":"cpe:2.3:a:drupal:mediafield_module:*:*:*:*:*:*:*:*","matchCriteriaId":"8B127C2E-8139-4515-9BC1-FC674A9119AA"}]}]}]},"legacy_mitre":{"record":{"CveYear":"2007","CveId":"1035","Ordinal":"1","Title":"CVE-2007-1035","CVE":"CVE-2007-1035","Year":"2007"},"notes":[{"CveYear":"2007","CveId":"1035","Ordinal":"1","NoteData":"Unspecified vulnerability in certain demonstration scripts in getID3 1.7.1, as used in the Mediafield and Audio modules for Drupal, allows remote attackers to read and delete arbitrary files, list arbitrary directories, and write to empty files or .mp3 files via unknown vectors.","Type":"Description","Title":"CVE-2007-1035"},{"CveYear":"2007","CveId":"1035","Ordinal":"2","NoteData":"2007-02-21","Type":"Other","Title":"Published"},{"CveYear":"2007","CveId":"1035","Ordinal":"3","NoteData":"2017-07-28","Type":"Other","Title":"Modified"}]}}}