Every CVESearch/Get API key

CVE-2007-4099

Tor before 0.1.2.15 can select a guard node beyond the first listed never-before-connected-to...

5.8 MediumFix available

CVE-2007-4099 is a medium vulnerability (CVSS 5.8) in Tor, published July 30, 2007. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.90%, the 79th percentile. Fixed in tor 0.1.2.15-1.

What does this mean?
Severity
5.8 MediumCVSS 2.0, NVD
Exploit chance
1.90%EPSS, 79th percentile
Exploitation
None knownNot on CISA’s or ENISA’s lists
Fixed in
0.1.2.15-1tor +2 more

Description

Tor before 0.1.2.15 can select a guard node beyond the first listed never-before-connected-to guard node, which allows remote attackers with control of certain guard nodes to obtain sensitive information and possibly leverage further attacks.

Exploit likelihood

1.90%Up 0.7 points since Feb 4, 2022
90%50%10%1%

Affected products

Affected packages

Affected packages
PackageAffectedFixed
tor
Debian:12
before 0.1.2.15-1
0.1.2.15-1
tor
Debian:13
before 0.1.2.15-1
0.1.2.15-1
tor
Debian:14
before 0.1.2.15-1
0.1.2.15-1

What each source reports

NVD Score used5.8

Tor before 0.1.2.15 can select a guard node beyond the first listed never-before-connected-to guard node, which allows remote attackers with control of certain guard nodes to obtain sensitive information and possibly leverage further attacks.

Record
CVE-2007-4099
CVSS 2.0
5.8 MediumAV:N/AC:M/Au:N/C:P/I:N/A:P
Updated
2026-11-02
CVE ListNo score

Tor before 0.1.2.15 can select a guard node beyond the first listed never-before-connected-to guard node, which allows remote attackers with control of certain guard nodes to obtain sensitive information and possibly leverage further attacks.

Record
CVE-2007-4099
Updated
2026-11-02
EUVDEUVD-2007-4083No score

Tor before 0.1.2.15 can select a guard node beyond the first listed never-before-connected-to guard node, which allows remote attackers with control of certain guard nodes to obtain sensitive information and possibly leverage further attacks.

Record
EUVD-2007-4083
Updated
2026-11-03
GitHub AdvisoriesGHSA-hvww-3pcr-wpmjNo score

Tor before 0.1.2.15 can select a guard node beyond the first listed never-before-connected-to...

Tor before 0.1.2.15 can select a guard node beyond the first listed never-before-connected-to guard node, which allows remote attackers with control of certain guard nodes to obtain sensitive information and possibly leverage further attacks.

Record
GHSA-hvww-3pcr-wpmj
Updated
2026-11-02
OSVNo score

Tor before 0.1.2.15 can select a guard node beyond the first listed never-before-connected-to guard node, which allows remote attackers with control of certain guard nodes to obtain sensitive information and possibly leverage further attacks.

Record
CVE-2007-4099
Updated
2026-11-02
OSVDEBIAN-CVE-2007-4099No score

Tor before 0.1.2.15 can select a guard node beyond the first listed never-before-connected-to guard node, which allows remote attackers with control of certain guard nodes to obtain sensitive information and possibly leverage further attacks.

Record
DEBIAN-CVE-2007-4099
Updated
2026-11-02

History

History
RecordedChangedSources
facts
aliasesEUVD
affected, aliases, facts, references, titleGitHub Advisories, OSV
first indexedCVE List, NVD

Dates are when Every CVE recorded each change. Upstream dates may differ.

References

PagesAll vulnerabilitiesBrowseDocsSourcesGuideGet API key
MoveEnter Open