CVEvulnerability

CVE-2007-4174

5.8 MEDIUM Published 2007-08-07 Modified 2026-06-16 Official page ↗
Status
Modified
Published
2007-08-07
Last modified
2026-06-16
Assigner
[email protected]
CVSS 2.0 ([email protected])
5.8 MEDIUM — AV:N/AC:M/Au:N/C:P/I:P/A:N
Weaknesses
CWE-264

Description

Tor before 0.1.2.16, when ControlPort is enabled, does not properly restrict commands to localhost port 9051, which allows remote attackers to modify the torrc configuration file, compromise anonymity, and have other unspecified impact via HTTP POST data containing commands without valid authentication, as demonstrated by an HTML form (1) hosted on a web site or (2) injected by a Tor exit node.

Affected configurations

• tor tor (<= 0.1.2.15) • tor tor 0.1.2.1 • tor tor 0.1.2.2 • tor tor 0.1.2.3 • tor tor 0.1.2.4 • tor tor 0.1.2.5 • tor tor 0.1.2.6 • tor tor 0.1.2.7 • tor tor 0.1.2.8 • tor tor 0.1.2.9 • tor tor 0.1.2.10 • tor tor 0.1.2.11 • tor tor 0.1.2.12 • tor tor 0.1.2.13 • tor tor 0.1.2.14

Related

Weakness · not in database (1)

References