CVE-2010-0004

Sažetak

ViewVC before 1.1.3 composes the root listing view without using the authorizer for each root, which might allow remote attackers to discover private root names by reading this view.

Reference

http://www.openwall.com/lists/oss-security/2010/01/13/5
https://www.redhat.com/archives/fedora-package-announce/2009-December/msg01421.html
https://www.redhat.com/archives/fedora-package-announce/2009-December/msg01464.html
http://viewvc.tigris.org/source/browse/viewvc/trunk/CHANGES?r1=2242&r2=2313&pathrev=HEAD
http://www.openwall.com/lists/oss-security/2010/01/11/2
http://viewvc.tigris.org/source/browse/viewvc?view=rev&revision=2300
http://lists.opensuse.org/opensuse-security-announce/2010-01/msg00009.html
http://www.openwall.com/lists/oss-security/2010/01/14/4
http://viewvc.tigris.org/source/browse/%2Acheckout%2A/viewvc/trunk/docs/release-notes/1.1.0.html?revision=2222

CVSS

Base:	5.0
Impact:	2.9
Exploitability:	10.0

Pristup

Vektor	Složenost	Autentikacija
NETWORK	LOW	NONE

Impact

Povjerljivost	Cjelovitost	Dostupnost
PARTIAL	NONE	NONE

CVSS vektor

AV:N/AC:L/Au:N/C:P/I:N/A:N

Zadnje važnije ažuriranje

07-11-2023 - 02:04

Objavljeno

29-01-2010 - 18:30