CVE-2008-1292

Description

ViewVC before 1.0.5 provides revision metadata without properly checking whether access was intended, which allows remote attackers to obtain sensitive information by reading (1) forbidden pathnames in the revision view, (2) log history that can only be reached by traversing a forbidden object, or (3) forbidden diff view path parameters.

References

http://www.vupen.com/english/advisories/2008/0734/references

http://www.securityfocus.com/bid/28055

http://viewvc.tigris.org/source/browse/viewvc/trunk/CHANGES?rev=HEAD

http://security.gentoo.org/glsa/glsa-200803-29.xml

http://secunia.com/advisories/29460

http://secunia.com/advisories/29176

http://bugs.gentoo.org/show_bug.cgi?id=212288

http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=471380

Details

Source: Mitre, NVD

Risk Information

CVSS v2

CVSS v3