CVE-2008-1290

Published: Mar 24, 2008Modified: Apr 23, 2026

4.3

Vector

AV:N/AC:M/Au:N/C:P/I:N/A:N

Exploitability: 8.6 / Impact: 2.9

Source: NVD

Description

ViewVC before 1.0.5 includes "all-forbidden" files within search results that list CVS or Subversion (SVN) commits, which allows remote attackers to obtain sensitive information.

Affected (2)

Products: Viewvc: Viewvc

Viewvc

1 product

Viewvc

Configuration A

2 vulnerable · 3 platform

Vulnerable Software	Affected Versions
Viewvc Viewvc	Version 1.0.2
Viewvc Viewvc	Version 1.0.3

Running on/with	Platform Versions
Gentoo Linux	All versions
Redhat Fedora	Version 7
Redhat Fedora	Version 8

Related CWEs

CWE-200

Exposure of Sensitive Information to an Unauthorized Actor

The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.

References (16)

http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=471380

Source: cve@mitre.org

http://bugs.gentoo.org/show_bug.cgi?id=212288

Source: cve@mitre.org

http://secunia.com/advisories/29176

Source: cve@mitre.org

Vendor Advisory

http://secunia.com/advisories/29460

Source: cve@mitre.org

Vendor Advisory

http://security.gentoo.org/glsa/glsa-200803-29.xml

Source: cve@mitre.org

http://viewvc.tigris.org/source/browse/viewvc/trunk/CHANGES?rev=HEAD

Source: cve@mitre.org

http://www.securityfocus.com/bid/28055

Source: cve@mitre.org

Patch

http://www.vupen.com/english/advisories/2008/0734/references

Source: cve@mitre.org

http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=471380