CVE-2008-1291 ViewVC before 1.0.5 stores sensitive information under the web root with insufficient access control, which allows remote attackers to read files and list folders under the hidden CVSROOT folder.
MediumCVSS 4.3
EPSS 1.4%
- Published
- Updated
- Exploit status
- No public exploit known
Description
ViewVC before 1.0.5 stores sensitive information under the web root with insufficient access control, which allows remote attackers to read files and list folders under the hidden CVSROOT folder.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| viewvc | = 1.0.2 | No fix listed |
| viewvc | = 1.0.3 | No fix listed |
References
- bugs.debian.org
- bugs.gentoo.org
- 29176 third-party-advisory vendor-advisory
- 29460 third-party-advisory vendor-advisory
- GLSA-200803-29 vendor-advisory
- viewvc.tigris.org
- 28055 patch vdb-entry
- ADV-2008-0734 vdb-entry