High · 7.3 CVE-2007-0184 EUVD-2022-2131GHSA-384c-gg34-g96h

Incorrect Authorization in Getahead Direct Web Remoting

Published Jan 11, 2007 · Updated Aug 7, 2024 · Assigned by mitre

Package: org.directwebremoting:dwr Ecosystem: Maven

Description

Getahead Direct Web Remoting (DWR) before 1.1.4 allows attackers to obtain unauthorized access to public methods via a crafted request that bypasses the include/exclude checks.

Affected packages

Ecosystem	Package	Affected	Fixed	Record
Maven	org.directwebremoting:dwr	< 1.1.4	1.1.4	GHSA-384c-gg34-g96h

References

32657 vdb-entry
23641 third-party-advisory
http://getahead.ltd.uk/dwr/changelog
ADV-2007-0095 vdb-entry
SUSE-SR:2009:004 vendor-advisory
21955 vdb-entry
dwr-include-exclude-security-bypass(31377) vdb-entry