CVE-2008-1291

NONE EPSS 68.6%

Published Mar 24, 200818y ago · Modified Jun 16, 20262w ago

Published Mar 24, 2008 18y ago

Last Modified Jun 16, 2026 2w ago

Description

ViewVC before 1.0.5 stores sensitive information under the web root with insufficient access control, which allows remote attackers to read files and list folders under the hidden CVSROOT folder.

Threat Intelligence

EPSS Exploit Probability

68.6% percentile

Exploit & Patch Status

No Known Exploit

Patch Available

Weaknesses 1

CWE-200 Exposure of Sensitive Information to an Unauthorized Actor Information Exposure

Affected Products 5

Vendor	Product	Version	Range
gentoo	linux	*	any
redhat	fedora	7	any
redhat	fedora	8	any
viewvc	viewvc	1.0.2	any
viewvc	viewvc	1.0.3	any

References 8

bugs.debian.org http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=471380
bugs.gentoo.org http://bugs.gentoo.org/show_bug.cgi?id=212288
secunia.com http://secunia.com/advisories/29176

Vendor Advisory
secunia.com http://secunia.com/advisories/29460

Vendor Advisory
security.gentoo.org http://security.gentoo.org/glsa/glsa-200803-29.xml
viewvc.tigris.org http://viewvc.tigris.org/source/browse/viewvc/trunk/CHANGES?rev=HEAD
securityfocus.com http://www.securityfocus.com/bid/28055

Patch
vupen.com http://www.vupen.com/english/advisories/2008/0734/references

Remediation

securityfocus.com http://www.securityfocus.com/bid/28055

Patch