PT-2008-3041 · Roundup · Roundup

Publicado 2008-03-24 · Atualizado 2022-05-01 · CVE-2008-1475

Positive Technologies (AI Summary)

CVSS v4.0

9.3

Crítica

Vetor base

AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions Roundup version 1.4.4

Description The issue concerns the xml-rpc server, which fails to check property permissions. This allows attackers to bypass restrictions and edit or read restricted properties using certain methods, specifically the list, display, and set methods.

Recommendations For Roundup version 1.4.4, update to a version that includes a fix for the xml-rpc server to properly check property permissions.

Correção

Improper Access Control

Enumeração de Fraquezas

CWE-264

CWE-284

Identificadores relacionados

CVE-2008-1475

GHSA-J59J-H3G7-CPMF

PYSEC-2008-10

Produtos afetados

Roundup

Referências · 24

• https://github.com/pypa/advisory-database/tree/main/vulns/roundup/PYSEC-2008-10.yaml · Nota
• https://github.com/roundup-tracker/roundup · Nota
• https://github.com/roundup-tracker/roundup/commit/c00b7e5801f8baa246fa76b4aad5287882310189 · Nota
• https://redhat.com/archives/fedora-package-announce/2008-March/msg00264.html · Aviso do Fabricante
• https://osv.dev/vulnerability/GHSA-j59j-h3g7-cpmf · Aviso do Fabricante
• http://sourceforge.net/tracker/index.php?func=detail&aid=1907211&group_id=31577&atid=402788 · Nota
• https://redhat.com/archives/fedora-package-announce/2008-November/msg00452.html · Aviso do Fabricante
• https://redhat.com/archives/fedora-package-announce/2008-March/msg00375.html · Aviso do Fabricante
• http://secunia.com/advisories/29375 · Aviso do Fabricante
• http://redhat.com/archives/fedora-package-announce/2008-November/msg00452.html · Nota
• https://redhat.com/archives/fedora-package-announce/2008-November/msg00478.html · Aviso do Fabricante
• http://secunia.com/advisories/29336 · Aviso do Fabricante
• https://osv.dev/vulnerability/PYSEC-2008-10 · Aviso do Fabricante
• https://bugzilla.redhat.com/show_bug.cgi?id=436546 · Nota
• http://security.gentoo.org/glsa/glsa-200805-21.xml · Aviso do Fabricante