PT-2008-1029 · Roundup · Roundup

Published 2008-03-24 · Updated 2022-05-01 · CVE-2008-1474

Positive Technologies (AI Summary)

CVSS v4.0

5.3

Medium

Base vector

AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N

Name of the Vulnerable Software and Affected Versions Roundup versions prior to 1.4.4

Description The issue concerns multiple unspecified vulnerabilities in the Roundup package, which can be exploited remotely. These vulnerabilities may lead to a breach of protected information integrity. Some of the vulnerabilities might be related to cross-site scripting (XSS), which is a type of attack where an attacker injects malicious code into a website, allowing them to steal user data or take control of the user's session.

Recommendations For versions prior to 1.4.4, update to version 1.4.4 or later to resolve the issue. As a temporary workaround, consider restricting access to the Roundup package to minimize the risk of exploitation. Avoid using the Roundup package for sensitive operations until the issue is resolved.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

BDU:2015-02584

CVE-2008-1474

DSA-1554-1

GHSA-C3QV-MF8H-434R

PYSEC-2008-9

Affected Products

Roundup

References · 23

• http://secunia.com/advisories/30274 · Vendor Advisory
• https://redhat.com/archives/fedora-package-announce/2008-March/msg00264.html · Vendor Advisory
• http://debian.org/security/2008/dsa-1554 · Vendor Advisory
• https://osv.dev/vulnerability/PYSEC-2008-9 · Vendor Advisory
• https://redhat.com/archives/fedora-package-announce/2008-March/msg00375.html · Vendor Advisory
• http://secunia.com/advisories/29375 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-1474 · Security Note
• http://secunia.com/advisories/29336 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2008-1474 · Security Note
• http://secunia.com/advisories/29848 · Vendor Advisory
• http://vupen.com/english/advisories/2008/0891 · Vendor Advisory
• http://security.gentoo.org/glsa/glsa-200805-21.xml · Vendor Advisory
• http://roundup.cvs.sourceforge.net/roundup/roundup/CHANGES.txt?revision=1.939&view=markup · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-c3qv-mf8h-434r · Vendor Advisory
• http://securityfocus.com/bid/28239 · Patch