CVE-2012-3357 The SVN revision view (lib/vclib/svn/svn_repos.py) in ViewVC before 1.1.15 does not properly handle log messages when a readable path is copied from an unreadable path, which allows remote attackers t...
MediumCVSS 5.0
EPSS 1.9%
- Published
- Updated
- Exploit status
- No public exploit known
Description
The SVN revision view (lib/vclib/svn/svn_repos.py) in ViewVC before 1.1.15 does not properly handle log messages when a readable path is copied from an unreadable path, which allows remote attackers to obtain sensitive information, related to a "log msg leak."
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| viewvc | <= 1.1.14 | No fix listed |
| viewvc | = 0.8 | No fix listed |
| viewvc | = 0.9 | No fix listed |
| viewvc | = 0.9.1 | No fix listed |
| viewvc | = 0.9.2 | No fix listed |
| viewvc | = 0.9.3 | No fix listed |
| viewvc | = 0.9.4 | No fix listed |
| viewvc | = 1.0.0 | No fix listed |
| viewvc | = 1.0.1 | No fix listed |
| viewvc | = 1.0.2 | No fix listed |
| viewvc | = 1.0.3 | No fix listed |
| viewvc | = 1.0.4 | No fix listed |
| viewvc | = 1.0.5 | No fix listed |
| viewvc | = 1.0.6 | No fix listed |
| viewvc | = 1.0.7 | No fix listed |
| viewvc | = 1.0.8 | No fix listed |
| viewvc | = 1.0.9 | No fix listed |
| viewvc | = 1.0.10 | No fix listed |
| viewvc | = 1.0.11 | No fix listed |
| viewvc | = 1.1.0 | No fix listed |
| viewvc | = 1.1.1 | No fix listed |
| viewvc | = 1.1.2 | No fix listed |
| viewvc | = 1.1.3 | No fix listed |
| viewvc | = 1.1.4 | No fix listed |
| viewvc | = 1.1.5 | No fix listed |
Show 8 more
| Product | Affected versions | Fixed in |
|---|---|---|
| viewvc | = 1.1.6 | No fix listed |
| viewvc | = 1.1.7 | No fix listed |
| viewvc | = 1.1.8 | No fix listed |
| viewvc | = 1.1.9 | No fix listed |
| viewvc | = 1.1.10 | No fix listed |
| viewvc | = 1.1.11 | No fix listed |
| viewvc | = 1.1.12 | No fix listed |
| viewvc | = 1.1.13 | No fix listed |
References
- 83227 vdb-entry
- viewvc.tigris.org
- DSA-2563 vendor-advisory
- MDVSA-2013:134 vendor-advisory
- [oss-security] 20120625 Re: CVE Request: viewvc mailing-list
- 54199 vdb-entry
- viewvc-svnra-info-disclosure(76615) vdb-entry
- openSUSE-SU-2012:0831 vendor-advisory
- wiki.mageia.org