Miggo Logo
Miggo Vulnerability Database
→
CVE-2007-1406

CVE-2007-1406: Trac missing Content-Disposition HTTP header

5.3

CVSS Score
3.1

Basic Information

CVE ID
CVE-2007-1406
GHSA ID
GHSA-7jjr-3r8r-9pcf
EPSS Score
0.62486%
CWE
-
Published
5/1/2022
Updated
11/18/2024
KEV Status
No
Technology
TechnologyPython

Technical Details

CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Package NameEcosystemVulnerable VersionsFirst Patched Version
tracpip< 0.10.3.10.10.3.1

Vulnerability Intelligence
Miggo AIMiggo AI

Miggo AIRoot Cause Analysis

The vulnerability relates to missing Content-Disposition headers in file attachment handling. Trac's attachment management system (trac.attachment module) is the logical component responsible for setting these headers. While no explicit patch details are available, the function serving attachments (send_attachment) would be the primary candidate for this omission. Confidence is medium due to lack of direct commit evidence, but the pattern matches common web security issues involving insecure file delivery.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

WAF Protection Rules

WAF Rule

Tr** ***or* *.**.*.* *o*s not s*n* * *ont*nt-*isposition *TTP *****r sp**i*yin* *n *tt***m*nt in **rt*in "uns***" situ*tions, w*i** **s unknown imp**t *n* r*mot* *tt**k v**tors.

Reasoning

T** vuln*r**ility r*l*t*s to missin* *ont*nt-*isposition *****rs in *il* *tt***m*nt **n*lin*. Tr**'s *tt***m*nt m*n***m*nt syst*m (tr**.*tt***m*nt mo*ul*) is t** lo*i**l *ompon*nt r*sponsi*l* *or s*ttin* t**s* *****rs. W*il* no *xpli*it p*t** **t*ils