CVE-2010-0004 ViewVC before 1.1.3 composes the root listing view without using the authorizer for each root, which might allow remote attackers to discover private root names by reading this view.
MediumCVSS 5.0
EPSS 2.6%
- Published
- Updated
- Exploit status
- No public exploit known
Description
ViewVC before 1.1.3 composes the root listing view without using the authorizer for each root, which might allow remote attackers to discover private root names by reading this view.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| viewvc | = 1.0.1 | No fix listed |
| viewvc | = 1.0.2 | No fix listed |
| viewvc | = 1.0.3 | No fix listed |
| viewvc | = 1.0.4 | No fix listed |
| viewvc | = 1.0.5 | No fix listed |
| viewvc | = 1.0.6 | No fix listed |
| viewvc | = 1.0.7 | No fix listed |
| viewvc | = 1.0.8 | No fix listed |
| viewvc | = 1.1.0 | No fix listed |
| viewvc | = 1.1.1 | No fix listed |
| viewvc | = 1.1.2 | No fix listed |
References
- SUSE-SA:2010:008 vendor-advisory
- viewvc.tigris.org
- viewvc.tigris.org
- viewvc.tigris.org
- [oss-security] 20100111 CVE Request: viewvc mailing-list
- [oss-security] 20100113 Re: CVE Request: viewvc mailing-list
- [oss-security] 20100114 Re: CVE Request: viewvc mailing-list
- FEDORA-2009-13610 vendor-advisory
- FEDORA-2009-13634 vendor-advisory