CVE-2008-1292

NONE EPSS 68.5%

Published Mar 24, 200818y ago · Modified Jun 16, 20262w ago

Published Mar 24, 2008 18y ago

Last Modified Jun 16, 2026 2w ago

Description

ViewVC before 1.0.5 provides revision metadata without properly checking whether access was intended, which allows remote attackers to obtain sensitive information by reading (1) forbidden pathnames in the revision view, (2) log history that can only be reached by traversing a forbidden object, or (3) forbidden diff view path parameters.

Threat Intelligence

EPSS Exploit Probability

68.5% percentile

Exploit & Patch Status

No Known Exploit

Patch Available

Weaknesses 1

CWE-200 Exposure of Sensitive Information to an Unauthorized Actor Information Exposure

Affected Products 5

Vendor	Product	Version	Range
gentoo	linux	*	any
redhat	fedora	7	any
redhat	fedora	8	any
viewvc	viewvc	1.0.2	any
viewvc	viewvc	1.0.3	any

References 8

bugs.debian.org http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=471380
bugs.gentoo.org http://bugs.gentoo.org/show_bug.cgi?id=212288
secunia.com http://secunia.com/advisories/29176

Vendor Advisory
secunia.com http://secunia.com/advisories/29460

Vendor Advisory
security.gentoo.org http://security.gentoo.org/glsa/glsa-200803-29.xml
viewvc.tigris.org http://viewvc.tigris.org/source/browse/viewvc/trunk/CHANGES?rev=HEAD
securityfocus.com http://www.securityfocus.com/bid/28055

Patch
vupen.com http://www.vupen.com/english/advisories/2008/0734/references

Remediation

securityfocus.com http://www.securityfocus.com/bid/28055

Patch