Lucene search

MitreCVE-2008-1475

HistoryMar 24, 2008 - 10:44 p.m.

CVE-2008-1475

2008-03-2422:44:00

CWE-264

mitre

web.nvd.nist.gov

xml-rpc

roundup 1.4.4

property permissions

security vulnerability

cve-2008-1475

CVSS2

6.4

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:L/Au:N/C:P/I:P/A:N

AI Score

6.1

Confidence

Low

EPSS

0.01

Percentile

83.8%

JSON

The xml-rpc server in Roundup 1.4.4 does not check property permissions, which allows attackers to bypass restrictions and edit or read restricted properties via the (1) list, (2) display, and (3) set methods.

Affected configurations

Nvd

Node

roundup-trackerroundupRange≤1.4.3

roundup-trackerroundupMatch0.1.0

roundup-trackerroundupMatch0.1.1

roundup-trackerroundupMatch0.1.2

roundup-trackerroundupMatch0.1.3

roundup-trackerroundupMatch0.2.0

roundup-trackerroundupMatch0.2.1

roundup-trackerroundupMatch0.2.2

roundup-trackerroundupMatch0.2.3

roundup-trackerroundupMatch0.2.4

roundup-trackerroundupMatch0.2.5

roundup-trackerroundupMatch0.2.6

roundup-trackerroundupMatch0.2.7

roundup-trackerroundupMatch0.2.8

roundup-trackerroundupMatch0.3.0

roundup-trackerroundupMatch0.3.0pre1

roundup-trackerroundupMatch0.3.0pre2

roundup-trackerroundupMatch0.3.0pre3

roundup-trackerroundupMatch0.4.0

roundup-trackerroundupMatch0.4.0b1

roundup-trackerroundupMatch0.4.0b2

roundup-trackerroundupMatch0.4.1

roundup-trackerroundupMatch0.4.2

roundup-trackerroundupMatch0.4.2pr1

roundup-trackerroundupMatch0.5

roundup-trackerroundupMatch0.5.0

roundup-trackerroundupMatch0.5.0beta1

roundup-trackerroundupMatch0.5.0beta2

roundup-trackerroundupMatch0.5.0pr1

roundup-trackerroundupMatch0.5.1

roundup-trackerroundupMatch0.5.2

roundup-trackerroundupMatch0.5.3

roundup-trackerroundupMatch0.5.4

roundup-trackerroundupMatch0.5.5

roundup-trackerroundupMatch0.5.6

roundup-trackerroundupMatch0.5.7

roundup-trackerroundupMatch0.5.8stable

roundup-trackerroundupMatch0.5.9

roundup-trackerroundupMatch0.6.0

roundup-trackerroundupMatch0.6.0b1

roundup-trackerroundupMatch0.6.0b2

roundup-trackerroundupMatch0.6.0b3

roundup-trackerroundupMatch0.6.0b4

roundup-trackerroundupMatch0.6.1

roundup-trackerroundupMatch0.6.2

roundup-trackerroundupMatch0.6.3

roundup-trackerroundupMatch0.6.4

roundup-trackerroundupMatch0.6.5

roundup-trackerroundupMatch0.6.6

roundup-trackerroundupMatch0.6.7

roundup-trackerroundupMatch0.6.8

roundup-trackerroundupMatch0.6.9

roundup-trackerroundupMatch0.6.10

roundup-trackerroundupMatch0.6.11

roundup-trackerroundupMatch0.7.0

roundup-trackerroundupMatch0.7.0b1

roundup-trackerroundupMatch0.7.0b2

roundup-trackerroundupMatch0.7.0b3

roundup-trackerroundupMatch0.7.1

roundup-trackerroundupMatch0.7.2

roundup-trackerroundupMatch0.7.3

roundup-trackerroundupMatch0.7.4

roundup-trackerroundupMatch0.7.5

roundup-trackerroundupMatch0.7.6

roundup-trackerroundupMatch0.7.7

roundup-trackerroundupMatch0.7.8

roundup-trackerroundupMatch0.7.9

roundup-trackerroundupMatch0.7.10

roundup-trackerroundupMatch0.7.11

roundup-trackerroundupMatch0.7.12

roundup-trackerroundupMatch0.8.0

roundup-trackerroundupMatch0.8.0b1

roundup-trackerroundupMatch0.8.0b2

roundup-trackerroundupMatch0.8.1

roundup-trackerroundupMatch0.8.2

roundup-trackerroundupMatch0.8.3

roundup-trackerroundupMatch0.8.4

roundup-trackerroundupMatch0.8.5

roundup-trackerroundupMatch0.8.6

roundup-trackerroundupMatch0.9.0b1

roundup-trackerroundupMatch1.0

roundup-trackerroundupMatch1.0.1

roundup-trackerroundupMatch1.1.0

roundup-trackerroundupMatch1.1.1

roundup-trackerroundupMatch1.1.2

roundup-trackerroundupMatch1.2.0

roundup-trackerroundupMatch1.2.1

roundup-trackerroundupMatch1.3.0

roundup-trackerroundupMatch1.3.1

roundup-trackerroundupMatch1.3.2

roundup-trackerroundupMatch1.3.3

roundup-trackerroundupMatch1.4.0

roundup-trackerroundupMatch1.4.1

roundup-trackerroundupMatch1.4.2

VendorProductVersionCPE
roundup-trackerroundup*cpe:2.3:a:roundup-tracker:roundup:*:*:*:*:*:*:*:*
roundup-trackerroundup0.1.0cpe:2.3:a:roundup-tracker:roundup:0.1.0:*:*:*:*:*:*:*
roundup-trackerroundup0.1.1cpe:2.3:a:roundup-tracker:roundup:0.1.1:*:*:*:*:*:*:*
roundup-trackerroundup0.1.2cpe:2.3:a:roundup-tracker:roundup:0.1.2:*:*:*:*:*:*:*
roundup-trackerroundup0.1.3cpe:2.3:a:roundup-tracker:roundup:0.1.3:*:*:*:*:*:*:*
roundup-trackerroundup0.2.0cpe:2.3:a:roundup-tracker:roundup:0.2.0:*:*:*:*:*:*:*
roundup-trackerroundup0.2.1cpe:2.3:a:roundup-tracker:roundup:0.2.1:*:*:*:*:*:*:*
roundup-trackerroundup0.2.2cpe:2.3:a:roundup-tracker:roundup:0.2.2:*:*:*:*:*:*:*
roundup-trackerroundup0.2.3cpe:2.3:a:roundup-tracker:roundup:0.2.3:*:*:*:*:*:*:*
roundup-trackerroundup0.2.4cpe:2.3:a:roundup-tracker:roundup:0.2.4:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
roundup-tracker	roundup	*	cpe:2.3:a:roundup-tracker:roundup::::::::
roundup-tracker	roundup	0.1.0	cpe:2.3:a:roundup-tracker:roundup:0.1.0:::::::*
roundup-tracker	roundup	0.1.1	cpe:2.3:a:roundup-tracker:roundup:0.1.1:::::::*
roundup-tracker	roundup	0.1.2	cpe:2.3:a:roundup-tracker:roundup:0.1.2:::::::*
roundup-tracker	roundup	0.1.3	cpe:2.3:a:roundup-tracker:roundup:0.1.3:::::::*
roundup-tracker	roundup	0.2.0	cpe:2.3:a:roundup-tracker:roundup:0.2.0:::::::*
roundup-tracker	roundup	0.2.1	cpe:2.3:a:roundup-tracker:roundup:0.2.1:::::::*
roundup-tracker	roundup	0.2.2	cpe:2.3:a:roundup-tracker:roundup:0.2.2:::::::*
roundup-tracker	roundup	0.2.3	cpe:2.3:a:roundup-tracker:roundup:0.2.3:::::::*
roundup-tracker	roundup	0.2.4	cpe:2.3:a:roundup-tracker:roundup:0.2.4:::::::*