PT-2008-1029 · Roundup · Roundup

Publicado 2008-03-24 · Atualizado 2022-05-01 · CVE-2008-1474

Positive Technologies (AI Summary)

CVSS v4.0

5.3

Média

Vetor base

AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N

Name of the Vulnerable Software and Affected Versions Roundup versions prior to 1.4.4

Description The issue concerns multiple unspecified vulnerabilities in the Roundup package, which can be exploited remotely. These vulnerabilities may lead to a breach of protected information integrity. Some of the vulnerabilities might be related to cross-site scripting (XSS), which is a type of attack where an attacker injects malicious code into a website, allowing them to steal user data or take control of the user's session.

Recommendations For versions prior to 1.4.4, update to version 1.4.4 or later to resolve the issue. As a temporary workaround, consider restricting access to the Roundup package to minimize the risk of exploitation. Avoid using the Roundup package for sensitive operations until the issue is resolved.

Correção

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

BDU:2015-02584

CVE-2008-1474

DSA-1554-1

GHSA-C3QV-MF8H-434R

PYSEC-2008-9

Produtos afetados

Roundup

Referências · 23

• https://github.com/pypa/advisory-database/tree/main/vulns/roundup/PYSEC-2008-9.yaml · Nota
• https://github.com/roundup-tracker/roundup · Nota
• https://github.com/roundup-tracker/roundup/commit/151ffd3367e7af563a92aabb3a8034a0f49063d9 · Nota
• http://secunia.com/advisories/30274 · Aviso do Fabricante
• https://redhat.com/archives/fedora-package-announce/2008-March/msg00264.html · Aviso do Fabricante
• http://debian.org/security/2008/dsa-1554 · Aviso do Fabricante
• https://osv.dev/vulnerability/PYSEC-2008-9 · Aviso do Fabricante
• https://redhat.com/archives/fedora-package-announce/2008-March/msg00375.html · Aviso do Fabricante
• http://secunia.com/advisories/29375 · Aviso do Fabricante
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-1474 · Nota de Segurança
• http://secunia.com/advisories/29336 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2008-1474 · Nota de Segurança
• http://secunia.com/advisories/29848 · Aviso do Fabricante
• http://vupen.com/english/advisories/2008/0891 · Aviso do Fabricante
• http://debian.org/security/dsa-1554 · Nota