CVE-2008-1291

Published: Mar 24, 2008Modified: Apr 23, 2026

4.3

Vector

AV:N/AC:M/Au:N/C:P/I:N/A:N

Exploitability: 8.6 / Impact: 2.9

Source: NVD

Description

ViewVC before 1.0.5 stores sensitive information under the web root with insufficient access control, which allows remote attackers to read files and list folders under the hidden CVSROOT folder.

Affected (2)

Products: Viewvc: Viewvc

Viewvc

1 product

Viewvc

Configuration A

2 vulnerable · 3 platform

Vulnerable Software	Affected Versions
Viewvc Viewvc	Version 1.0.2
Viewvc Viewvc	Version 1.0.3

Running on/with	Platform Versions
Gentoo Linux	All versions
Redhat Fedora	Version 7
Redhat Fedora	Version 8

Related CWEs

CWE-200

Exposure of Sensitive Information to an Unauthorized Actor

The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.

References (16)

http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=471380

Source: cve@mitre.org

http://bugs.gentoo.org/show_bug.cgi?id=212288

Source: cve@mitre.org

http://secunia.com/advisories/29176

Source: cve@mitre.org

Vendor Advisory

http://secunia.com/advisories/29460

Source: cve@mitre.org

Vendor Advisory

http://security.gentoo.org/glsa/glsa-200803-29.xml

Source: cve@mitre.org

http://viewvc.tigris.org/source/browse/viewvc/trunk/CHANGES?rev=HEAD

Source: cve@mitre.org

http://www.securityfocus.com/bid/28055

Source: cve@mitre.org

Patch

http://www.vupen.com/english/advisories/2008/0734/references

Source: cve@mitre.org

http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=471380