CVE-2007-2233

MEDIUM 6.5CVE-2007-2233 · Published 25/04/2007 · updated 16/06/2026

In short

CVE-2007-2233 is a MEDIUM (CVSS 6.5) vulnerability affecting cosign (cosign).
Chance of exploitation in the next 30 days (EPSS): 2.0%, higher than 80.7% of all vulnerabilities.
No patched version is listed yet: follow the vendor's advisory in References.

Package	Affected versions	Patched versions
cosign cosign	`= 0.7.0= 0.8.0= 0.9.0= 1.0= 1.1= 1.5= 1.6= 1.7= 1.8= 1.8.5= 1.9= 2.0.1= 2.0.2`	No fix yet

Description

cosign-bin/cosign.cgi in Cosign 2.0.2 and earlier allows remote authenticated users to perform unauthorized actions as an arbitrary user by using CR (\r) sequences in the service parameter to inject LOGIN and REGISTER commands with the desired username.

References

secunia.com/advisories/24845 · Patch
securityfocus.com/archive/1/465386/100/100/threaded
umich.edu/~umweb/software/cosign/cosign-vuln-2007-002.txt · Vendor Advisory
vupen.com/english/advisories/2007/1359

More vulnerabilities in cosign

See all →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free