CVE-2008-1291

EPSS 0.66%
Veröffentlicht 24.03.2008 17:44:00
Zuletzt bearbeitet 09.04.2025 00:30:58
Quelle cve@mitre.org
Teams Watchlist Login
Unerledigt Login

ViewVC before 1.0.5 stores sensitive information under the web root with insufficient access control, which allows remote attackers to read files and list folders under the hidden CVSROOT folder.

Betroffene Produkte Warnungen 0 Metriken 2 CWE 1 Referenzen 11

Daten sind bereitgestellt durch National Vulnerability Database (NVD)

Viewvc ≫ Viewvc Version1.0.2

   Gentoo ≫ Linux
   Redhat ≫ Fedora Version7
   Redhat ≫ Fedora Version8

Viewvc ≫ Viewvc Version1.0.3

   Gentoo ≫ Linux
   Redhat ≫ Fedora Version7
   Redhat ≫ Fedora Version8

Zu dieser CVE wurde keine CISA KEV oder CERT.AT-Warnung gefunden.

EPSS Metriken
Typ	Quelle	Score	Percentile
EPSS	FIRST.org	0.66%	0.702

CVSS Metriken
Quelle	Base Score	Exploit Score	Impact Score	Vector String
nvd@nist.gov	4.3	8.6	2.9	AV:N/AC:M/Au:N/C:P/I:N/A:N

CWE-200 Exposure of Sensitive Information to an Unauthorized Actor

The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.

http://viewvc.tigris.org/source/browse/viewvc/trunk/CHANGES?rev=HEAD

http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=471380

http://bugs.gentoo.org/show_bug.cgi?id=212288

http://secunia.com/advisories/29176

Vendor Advisory

http://secunia.com/advisories/29460

Vendor Advisory

http://security.gentoo.org/glsa/glsa-200803-29.xml

http://www.securityfocus.com/bid/28055

Patch

http://www.vupen.com/english/advisories/2008/0734/references

https://nvd.nist.gov/vuln/detail/CVE-2008-1291

CVE Source (NVD)

https://cveawg.mitre.org/api/cve/CVE-2008-1291

CVE Source (JSON)

https://euvd.enisa.europa.eu/vulnerability/CVE-2008-1291

EUVD