4.3

CVE-2008-1291

ViewVC before 1.0.5 stores sensitive information under the web root with insufficient access control, which allows remote attackers to read files and list folders under the hidden CVSROOT folder.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Viewvc ≫ Viewvc Version1.0.2
   Gentoo ≫ Linux
   Redhat ≫ Fedora Version7
   Redhat ≫ Fedora Version8
Viewvc ≫ Viewvc Version1.0.3
   Gentoo ≫ Linux
   Redhat ≫ Fedora Version7
   Redhat ≫ Fedora Version8
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 1.37% 0.683
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
nvd@nist.gov 4.3 8.6 2.9
AV:N/AC:M/Au:N/C:P/I:N/A:N
CWE-200 Exposure of Sensitive Information to an Unauthorized Actor

The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.

http://viewvc.tigris.org/source/browse/viewvc/trunk/CHANGES?rev=HEAD
http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=471380
http://bugs.gentoo.org/show_bug.cgi?id=212288
http://secunia.com/advisories/29176
Vendor Advisory
http://secunia.com/advisories/29460
Vendor Advisory
http://security.gentoo.org/glsa/glsa-200803-29.xml
http://www.securityfocus.com/bid/28055
Patch
http://www.vupen.com/english/advisories/2008/0734/references