| ID | CVE-2009-2737 | ||||||
| Sažetak | The EditCSVAction function in cgi/actions.py in Roundup 1.2 before 1.2.1, 1.4 through 1.4.6, and possibly other versions does not properly check permissions, which allows remote authenticated users with edit or create privileges for a class to modify arbitrary items within that class, as demonstrated by editing all queries, modifying settings, and adding roles to users. | ||||||
| Reference |
|
||||||
| CVSS |
|
||||||
| Pristup |
|
||||||
| Impact |
|
||||||
| CVSS vektor | AV:N/AC:L/Au:S/C:N/I:P/A:P | ||||||
| Zadnje važnije ažuriranje | 26-08-2009 - 05:25 | ||||||
| Objavljeno | 11-08-2009 - 10:30 |
