4.6

CVE-2008-0167

The write_array_file function in utils/include.pl in GForge 4.5.14 updates configuration files by truncating them to zero length and then writing new data, which might allow attackers to bypass intended access restrictions or have unspecified other impact in opportunistic circumstances.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Gforge ≫ Gforge Version 4.5.14
   Debian ≫ Debian Linux Version 4.0
   Debian ≫ Debian Linux Version 4.0 Edition alpha
   Debian ≫ Debian Linux Version 4.0 Edition amd64
   Debian ≫ Debian Linux Version 4.0 Edition arm
   Debian ≫ Debian Linux Version 4.0 Edition hppa
   Debian ≫ Debian Linux Version 4.0 Edition ia-32
   Debian ≫ Debian Linux Version 4.0 Edition ia-64
   Debian ≫ Debian Linux Version 4.0 Edition m68k
   Debian ≫ Debian Linux Version 4.0 Edition mips
   Debian ≫ Debian Linux Version 4.0 Edition mipsel
   Debian ≫ Debian Linux Version 4.0 Edition powerpc
   Debian ≫ Debian Linux Version 4.0 Edition s390
   Debian ≫ Debian Linux Version 4.0 Edition sparc
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 0.73% 0.494
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
NIST 4.6 3.9 6.4
AV:L/AC:L/Au:N/C:P/I:P/A:P
CWE-59 Improper Link Resolution Before File Access ('Link Following')

The product attempts to access a file based on the filename, but it does not properly prevent that filename from identifying a link or shortcut that resolves to an unintended resource.

http://secunia.com/advisories/30088
Vendor Advisory
http://secunia.com/advisories/30286
Vendor Advisory
http://security.debian.org/pool/updates/main/g/gforge/gforge_4.5.14-22etch8.diff.gz
http://www.debian.org/security/2008/dsa-1577
Patch
http://www.securityfocus.com/bid/29215
http://www.vupen.com/english/advisories/2008/1537/references
https://exchange.xforce.ibmcloud.com/vulnerabilities/42456