CVE-2007-2197

Severity: medium (CVSS 5.0 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.2% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2007-04-24 · updated 2026-06-16

Description

Race condition in the NeatUpload ASP.NET component 1.2.11 through 1.2.16, 1.1.18 through 1.1.23, and trunk.379 through trunk.445 allows remote attackers to obtain other clients' HTTP responses via multiple simultaneous requests, which triggers multiple calls to HttpWorkerRequest.FlushResponse for the same HttpWorkerRequest object and causes a buffer to be reused for a different request.

Affected products

Brettle Development Neatupload: 1.1.18, 1.1.19, 1.1.20, 1.1.21, 1.1.22, 1.1.23 (+9)

References

http://secunia.com/advisories/25003
http://www.securityfocus.com/archive/1/466404/100/0/threaded
http://www.securityfocus.com/bid/23578
https://exchange.xforce.ibmcloud.com/vulnerabilities/33785
http://secunia.com/advisories/25003
http://www.securityfocus.com/archive/1/466404/100/0/threaded
http://www.securityfocus.com/bid/23578
https://exchange.xforce.ibmcloud.com/vulnerabilities/33785

Get alerted when CVE-2007-2197 or the next vulnerability affects your stack