Detections
Analytics

CVS < 1.11.15 / 1.12.7 Client Traversal Arbitrary File Retrieval

medium Nessus Network Monitor Plugin ID 1219

Synopsis

The remote host is vulnerable to a directory traversal flaw

Description

The remote CVS server, according to its version number, might allow an attacker to checkout RCS archive files that are outside of the cvs root.

Solution

Upgrade to CVS 1.11.15, 1.12.7 or later.

See Also

http://www.openbsd.org/errata35.html#cvs

Plugin Details

Severity: Medium

ID: 1219

Family: Generic

Published: 8/20/2004

Updated: 3/6/2019

Nessus ID: 12212

Risk Information

VPR

Risk Factor: Low

Score: 3.7

CVSS v2

Risk Factor: Medium

Base Score: 5

Temporal Score: 3.7

Vector: CVSS2#AV:N/AC:L/Au:N/C:P/I:N/A:N

CVSS v3

Risk Factor: Medium

Base Score: 5.3

Temporal Score: 4.6

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

Vulnerability Information

CPE: cpe:/a:cvs:cvs

Reference Information

CVE: CVE-2004-0405

BID: 10140