PT-2008-3041 · Roundup · Roundup

Published 2008-03-24 · Updated 2022-05-01 · CVE-2008-1475

Positive Technologies (AI Summary)

CVSS v4.0

9.3

Critical

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions Roundup version 1.4.4

Description The issue concerns the xml-rpc server, which fails to check property permissions. This allows attackers to bypass restrictions and edit or read restricted properties using certain methods, specifically the list, display, and set methods.

Recommendations For Roundup version 1.4.4, update to a version that includes a fix for the xml-rpc server to properly check property permissions.

Fix

Improper Access Control

Weakness Enumeration

CWE-264

CWE-284

Related Identifiers

CVE-2008-1475

GHSA-J59J-H3G7-CPMF

PYSEC-2008-10

Affected Products

Roundup

References · 24

• https://redhat.com/archives/fedora-package-announce/2008-March/msg00264.html · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-j59j-h3g7-cpmf · Vendor Advisory
• https://redhat.com/archives/fedora-package-announce/2008-November/msg00452.html · Vendor Advisory
• https://redhat.com/archives/fedora-package-announce/2008-March/msg00375.html · Vendor Advisory
• http://secunia.com/advisories/29375 · Vendor Advisory
• https://redhat.com/archives/fedora-package-announce/2008-November/msg00478.html · Vendor Advisory
• http://secunia.com/advisories/29336 · Vendor Advisory
• https://osv.dev/vulnerability/PYSEC-2008-10 · Vendor Advisory
• http://security.gentoo.org/glsa/glsa-200805-21.xml · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2008-1475 · Security Note
• https://github.com/pypa/advisory-database/tree/main/vulns/roundup/PYSEC-2008-10.yaml · Note
• https://github.com/roundup-tracker/roundup · Note
• https://github.com/roundup-tracker/roundup/commit/c00b7e5801f8baa246fa76b4aad5287882310189 · Note
• http://sourceforge.net/tracker/index.php?func=detail&aid=1907211&group_id=31577&atid=402788 · Note
• http://redhat.com/archives/fedora-package-announce/2008-November/msg00452.html · Note