PT-2010-1817 · Turbogears · Turbogears2

Mark Ramm-Christensen · Published 2010-11-05 · Updated 2010-11-09 · CVE-2009-5015

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions TurboGears2 versions prior to 2.0.2

Description The issue in TurboGears2 concerns the URL dispatch mechanism, which exposes controller methods even when an @expose decoration is not used. This has an unspecified impact and attack vectors.

Recommendations For versions prior to 2.0.2, update to version 2.0.2 or later to resolve the issue.

Fix

Related Identifiers

CVE-2009-5015

Affected Products

Turbogears2

References · 2

• https://nvd.nist.gov/vuln/detail/CVE-2009-5015 · Security Note
• http://groups.google.com/group/turbogears-announce/msg/09ec26696b1761bb?dmode=source&output=gplain · Note