CVE-2007-0184
Incorrect Authorization in Getahead Direct Web Remoting
Getahead Direct Web Remoting (DWR) before 1.1.4 allows attackers to obtain unauthorized access to public methods via a crafted request that bypasses the include/exclude checks.
Exploit likelihood
What each source reports
NVD Score used
Getahead Direct Web Remoting (DWR) before 1.1.4 allows attackers to obtain unauthorized access to public methods via a crafted request that bypasses the include/exclude checks.
- Record
CVE-2007-0184- CVSS 2.0
- 7.5 High
AV:N/AC:L/Au:N/C:P/I:P/A:P - Updated
- 2026-11-02
CVE List No score
Getahead Direct Web Remoting (DWR) before 1.1.4 allows attackers to obtain unauthorized access to public methods via a crafted request that bypasses the include/exclude checks.
- Record
CVE-2007-0184- Updated
- 2026-11-02
EUVDEUVD-2022-2131 No score
Getahead Direct Web Remoting (DWR) before 1.1.4 allows attackers to obtain unauthorized access to public methods via a crafted request that bypasses the include/exclude checks.
- Record
EUVD-2022-2131- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-384c-gg34-g96h
Incorrect Authorization in Getahead Direct Web Remoting
Getahead Direct Web Remoting (DWR) before 1.1.4 allows attackers to obtain unauthorized access to public methods via a crafted request that bypasses the include/exclude checks.
- Record
GHSA-384c-gg34-g96h- CVSS 3.1
- 7.3 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L - Weakness
- CWE-863
- Updated
- 2026-11-02
OSVGHSA-384c-gg34-g96h
Incorrect Authorization in Getahead Direct Web Remoting
Getahead Direct Web Remoting (DWR) before 1.1.4 allows attackers to obtain unauthorized access to public methods via a crafted request that bypasses the include/exclude checks.
- Record
GHSA-384c-gg34-g96h- CVSS 3.1
- 7.3 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L - Weakness
- CWE-863
- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
org.directwebremoting:dwrMaven |
before 1.1.4 | 1.1.4 |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2007-0184 is a high vulnerability (CVSS 7.5) in Getahead Direct Web Remoting, published January 11, 2007. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.50%, the 74th percentile. Fixed in org.directwebremoting:dwr 1.1.4.
References
osvdb.org/32657
secunia.com/advisories/23641
getahead.ltd.uk/dwr/changelog
vupen.com/english/advisories/2007/0095
lists.opensuse.org/opensuse-security-announce/2009-02/msg00002.html
securityfocus.com/bid/21955
exchange.xforce.ibmcloud.com/vulnerabilities/31377
nvd.nist.gov/vuln/detail/CVE-2007-0184
github.com/advisories/GHSA-384c-gg34-g96h