PT-2011-1047 · Debian · Viewvc

Ludwig Nussel · Publicado 2011-05-23 · Atualizado 2024-06-15 · CVE-2012-3357

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Média

Vetor base

AV:N/AC:L/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions ViewVC versions prior to 1.1.15

Description The issue concerns multiple vulnerabilities in the ViewVC package of the Debian GNU/Linux operating system, which can be exploited remotely to compromise the confidentiality of protected information. Specifically, the SVN revision view in ViewVC does not properly handle log messages when a readable path is copied from an unreadable path, allowing remote attackers to obtain sensitive information, related to a "log msg leak."

Recommendations For versions prior to 1.1.15, update to version 1.1.15 or later to resolve the issue. As a temporary workaround, consider restricting access to the SVN revision view functionality until a patch is available.

Correção

Information Disclosure

Enumeração de Fraquezas

CWE-399

CWE-200

Identificadores relacionados

BDU:2015-03044

CVE-2012-3357

DSA-2563-1

OPENSUSE-SU-2024:10175-1

Produtos afetados

Viewvc

Referências · 23

• http://mandriva.com/security/advisories?name=MDVSA-2013:134 · Aviso do Fabricante
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-3357 · Nota
• https://bdu.fstec.ru/vul/2015-03044 · Nota de Segurança
• https://suse.com/security/cve/CVE-2012-3357 · Nota
• https://osv.dev/vulnerability/UBUNTU-CVE-2012-3357 · Aviso do Fabricante
• http://osvdb.org/83227 · Nota
• https://wiki.mageia.org/en/Support/Advisories/MGASA-2012-0175 · Nota
• https://cve.org/CVERecord?id=CVE-2012-3357 · Nota de Segurança
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-5024 · Nota de Segurança
• https://exchange.xforce.ibmcloud.com/vulnerabilities/76615 · Nota
• http://viewvc.tigris.org/source/browse/viewvc?view=rev&revision=2758 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2012-3357 · Nota de Segurança
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-3357 · Nota de Segurança
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-4533 · Nota de Segurança
• http://openwall.com/lists/oss-security/2012/06/25/8 · Nota