PT-2018-4248 · Beanbag · Review Board

Uchida · Publicado 2018-03-29 · Atualizado 2018-04-24 · CVE-2014-5028

Positive Technologies (AI Summary)

CVSS v2.0

4.0

Média

Vetor base

AV:N/AC:L/Au:S/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions Review Board versions 1.7.x through 1.7.26 Review Board versions 2.0.x through 2.0.3

Description The issue allows remote authenticated users to bypass intended access restrictions and obtain sensitive information from repository files by leveraging knowledge of database ids.

Recommendations For Review Board versions 1.7.x through 1.7.26, update to version 1.7.27 or later. For Review Board versions 2.0.x through 2.0.3, update to version 2.0.4 or later.

Correção

Information Disclosure

Enumeração de Fraquezas

CWE-200

Identificadores relacionados

CVE-2014-5028

Produtos afetados

Review Board

Referências · 7

• https://reviewboard.org/docs/releasenotes/reviewboard/1.7.27 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2014-5028 · Nota de Segurança
• http://openwall.com/lists/oss-security/2014/07/22/12 · Nota
• https://exchange.xforce.ibmcloud.com/vulnerabilities/94813 · Nota
• https://reviewboard.org/news/2014/07/22/review-board-1-7-27-and-2-0-3-security-releases · Aviso do Fabricante
• https://reviewboard.org/docs/releasenotes/reviewboard/2.0.4 · Aviso do Fabricante
• https://bugzilla.redhat.com/show_bug.cgi?id=1123692 · Nota