CVE-2012-3356 The remote SVN views functionality (lib/vclib/svn/svn_ra.py) in ViewVC before 1.1.15 does not properly perform authorization, which allows remote attackers to bypass intended access restrictions via u...
MediumCVSS 5.0
EPSS 2.0%
- Published
- Updated
- Exploit status
- No public exploit known
Description
The remote SVN views functionality (lib/vclib/svn/svn_ra.py) in ViewVC before 1.1.15 does not properly perform authorization, which allows remote attackers to bypass intended access restrictions via unspecified vectors.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| viewvc | <= 1.1.14 | No fix listed |
| viewvc | = 0.8 | No fix listed |
| viewvc | = 0.9 | No fix listed |
| viewvc | = 0.9.1 | No fix listed |
| viewvc | = 0.9.2 | No fix listed |
| viewvc | = 0.9.3 | No fix listed |
| viewvc | = 0.9.4 | No fix listed |
| viewvc | = 1.0.0 | No fix listed |
| viewvc | = 1.0.1 | No fix listed |
| viewvc | = 1.0.2 | No fix listed |
| viewvc | = 1.0.3 | No fix listed |
| viewvc | = 1.0.4 | No fix listed |
| viewvc | = 1.0.5 | No fix listed |
| viewvc | = 1.0.6 | No fix listed |
| viewvc | = 1.0.7 | No fix listed |
| viewvc | = 1.0.8 | No fix listed |
| viewvc | = 1.0.9 | No fix listed |
| viewvc | = 1.0.10 | No fix listed |
| viewvc | = 1.0.11 | No fix listed |
| viewvc | = 1.1.0 | No fix listed |
| viewvc | = 1.1.1 | No fix listed |
| viewvc | = 1.1.2 | No fix listed |
| viewvc | = 1.1.3 | No fix listed |
| viewvc | = 1.1.4 | No fix listed |
| viewvc | = 1.1.5 | No fix listed |
Show 8 more
| Product | Affected versions | Fixed in |
|---|---|---|
| viewvc | = 1.1.6 | No fix listed |
| viewvc | = 1.1.7 | No fix listed |
| viewvc | = 1.1.8 | No fix listed |
| viewvc | = 1.1.9 | No fix listed |
| viewvc | = 1.1.10 | No fix listed |
| viewvc | = 1.1.11 | No fix listed |
| viewvc | = 1.1.12 | No fix listed |
| viewvc | = 1.1.13 | No fix listed |
References
- 83225 vdb-entry
- viewvc.tigris.org
- viewvc.tigris.org
- viewvc.tigris.org
- viewvc.tigris.org
- viewvc.tigris.org
- viewvc.tigris.org
- viewvc.tigris.org
- DSA-2563 vendor-advisory
- MDVSA-2013:134 vendor-advisory
- [oss-security] 20120625 Re: CVE Request: viewvc mailing-list
- 54197 vdb-entry
- viewvc-svnra-security-bypass(76614) vdb-entry
- openSUSE-SU-2012:0831 vendor-advisory
- wiki.mageia.org