← Vulnerability feed

Vulnerability record · CVE-2007-3018 · published 17 July 2007

CVE-2007-3018: Activeweb contentserver vulnerability

Activeweb · Contentserver

activeWeb contentserver CMS before 5.6.2964 does not limit the file-creation ability of editors who have restricted accounts, which allows these editors to create files in arbitrary directories.

4.0 CVSS 2.0 Medium EPSS 1.0% · top 38.6%
4.0CVSS 2.0 base score
1.0%EPSS exploitation probability, 30 days
NoNot in CISA KEV
1Affected product versions listed by NVD
14References
16 Jun 2026Last modified by NVD

Description

activeWeb contentserver CMS before 5.6.2964 does not limit the file-creation ability of editors who have restricted accounts, which allows these editors to create files in arbitrary directories.

AV:N/AC:L/Au:S/C:N/I:P/A:N

Affected products

1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

References

LinkTags
http://osvdb.org/39746
http://secunia.com/advisories/26063 Vendor Advisory
http://securityreason.com/securityalert/2899
http://www.redteam-pentesting.de/advisories/rt-sa-2007-007.php
http://www.securityfocus.com/archive/1/473629/100/0/threaded
http://www.securityfocus.com/bid/24900
https://exchange.xforce.ibmcloud.com/vulnerabilities/35400
http://osvdb.org/39746
http://secunia.com/advisories/26063 Vendor Advisory
http://securityreason.com/securityalert/2899
http://www.redteam-pentesting.de/advisories/rt-sa-2007-007.php
http://www.securityfocus.com/archive/1/473629/100/0/threaded
http://www.securityfocus.com/bid/24900
https://exchange.xforce.ibmcloud.com/vulnerabilities/35400

Track CVE-2007-3018 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

6.5CVE-2007-3013Activeweb contentserver vulnerabilitySQL injection vulnerability in activeWeb contentserver before 5.6.2964 allows remote authenticated users with edit permission to execute arbitrary SQ…EPSS 2.9%4.3CVE-2007-3014Activeweb contentserver vulnerabilityMultiple cross-site scripting (XSS) vulnerabilities in activeWeb contentserver before 5.6.2964 allow remote attackers to inject arbitrary web script …EPSS 4.5%4.0CVE-2007-3017Activeweb contentserver vulnerabilityThe WYSIWYG editor applet in activeWeb contentserver CMS before 5.6.2964 only filters malicious tags from articles sent to admin/applets/wysiwyg/rend…EPSS 5.1%

Source: NIST National Vulnerability Database (record CVE-2007-3018), CISA KEV, FIRST EPSS (scores of 2026-09-27). This page is refreshed as NVD updates the record.