CVE-2007-3816
JWIG might allow context-dependent attackers to cause a denial of service (service degradation) via loops of references to external…
- 7.5HighCVSS base score
- 2.1%Exploitation in 30 daysEPSS · top 18% of all CVEs
- NoKnown exploitednot in CISA's KEV catalog
- NonePublic exploitsnone known yet
Description
JWIG might allow context-dependent attackers to cause a denial of service (service degradation) via loops of references to external templates. NOTE: this issue has been disputed by multiple third parties who state that only the application developer can trigger the issue, so no privilege boundaries are crossed. However, it seems possible that this is a vulnerability class to which an JWIG application may be vulnerable if template contents can be influenced, but this would be an issue in the application itself, not JWIG
Timeline
ID reserved
By mitre
- 1 day later
· 1 day later
Published
- 18 years later
· 18 years later
Record updated
Changes after publication (a new score, a public exploit, EPSS crossing 1, 10 or 50 %, leaving KEV) are kept since November 2026; earlier ones are not known.
Scores
| Scored by | CVSS | Score | Vector |
|---|---|---|---|
| CISA-ADPADP (enrichment) | 3.1 | High7.5 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H |
| NVDNVD · Modified | 3.1 | High7.5 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H |
- EPSS (exploitation in 30 days)
- 2.1% · top 18% of all CVEs (9 Nov 2026)
- CISA SSVC
- Exploitation: none · Automatable: yes · Technical impact: partial
The list uses the assigner's score when there is one, then CISA's, then NVD's: High 7.5.
Affected products
n/a
- affected n/a
References
11
- 20070723 [CVE 2007-3816] [Advisory] Vulnerability Facts Related JWIG Advisory (opens in a new tab)mailing-listx_refsource_FULLDISCx_transferred
- jwig-externaltemplate-dos(35515) (opens in a new tab)vdb-entryx_refsource_XFx_transferred
- 20070716 WhitePapers By SecNiche Security (opens in a new tab)mailing-listx_refsource_BUGTRAQx_transferred
- http://www.secniche.org/papers/HackAnnotationsInJWIG.pdf (opens in a new tab)x_refsource_MISCx_transferred
- 20070721 [CVE-2007-3816][Advisory] JWIG Context-Dependent Template Calling Dos (opens in a new tab)mailing-listx_refsource_FULLDISCx_transferred
- 1018432 (opens in a new tab)vdb-entryx_refsource_SECTRACKx_transferred
- 20070721 Re: [WEB SECURITY] [CVE-2007-3816][Advisory] JWIG Context-Dependent Template Calling Dos (opens in a new tab)mailing-listx_refsource_BUGTRAQx_transferred
- 24974 (opens in a new tab)vdb-entryx_refsource_BIDx_transferred
- 20070721 [CVE-2007-3816][Advisory] JWIG Context-Dependent Template Calling Dos (opens in a new tab)mailing-listx_refsource_BUGTRAQx_transferred
- 20070722 Re: [CVE 2007-3816] [Advisory] Vulnerability Facts Related JWIG Advisory (opens in a new tab)mailing-listx_refsource_FULLDISCx_transferred
- 20070726 [CVE 2007-3816] [Advisory] Vulnerability Facts Related JWIG Advisory (opens in a new tab)mailing-listx_refsource_FULLDISCx_transferred
Sources
The same CVE in the primary databases and aggregators, to check against.
- CVE.org record (opens in a new tab)
- CVE List JSON (GitHub) (opens in a new tab)
- NVD (opens in a new tab)
- FIRST EPSS (opens in a new tab)
- EUVD EUVD-2007-3800 (opens in a new tab)
- OSV.dev (opens in a new tab)
- GitHub Advisories (opens in a new tab)
- CIRCL Vulnerability-Lookup (opens in a new tab)
Badge for a README or a ticket
[](https://cveledger.app/cve/CVE-2007-3816)Record last updated .