CVE-2010-1326

2022-10-0316:21:01

CWE-264

[email protected]

web.nvd.nist.gov

cve-2010-1326

perms.cpp

march hare software

cvsnt

permissions bypass

arbitrary code execution

security vulnerability

9.3 High

CVSS2

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:N/AC:M/Au:N/C:C/I:C/A:C

7.5 High

AI Score

Confidence

Low

0.063 Low

EPSS

Percentile

93.6%

JSON

perms.cpp in March Hare Software CVSNT 2.0.58, 2.5.01, 2.5.02, 2.5.03 before build 3736, 2.5.04 before build 2862; CVS Suite 2.5.03, 2008 before build 3736, and 2009 before 3729 allows remote attackers to bypass the permissions check, modify arbitrary modules and directories within CVSROOT, and execute arbitrary code via a crafted branch name ACL, possibly related to incorrect inheritance.

Affected configurations

NVD

Node

march-harecvs_suiteMatch2.5.03

march-harecvs_suiteMatch2008

march-harecvs_suiteMatch2009pre-release

march-harecvsntMatch2.0.58

march-harecvsntMatch2.5.01

march-harecvsntMatch2.5.02

march-harecvsntMatch2.5.03

march-harecvsntMatch2.5.04

CPENameOperatorVersion
march-hare:cvs_suitemarch-hare cvs suiteeq2.5.03
march-hare:cvs_suitemarch-hare cvs suiteeq2008
march-hare:cvs_suitemarch-hare cvs suiteeq2009
march-hare:cvsntmarch-hare cvsnteq2.0.58
march-hare:cvsntmarch-hare cvsnteq2.5.01
march-hare:cvsntmarch-hare cvsnteq2.5.02
march-hare:cvsntmarch-hare cvsnteq2.5.03
march-hare:cvsntmarch-hare cvsnteq2.5.04

CPE	Name	Operator	Version
march-hare:cvs_suite	march-hare cvs suite	eq	2.5.03
march-hare:cvs_suite	march-hare cvs suite	eq	2008
march-hare:cvs_suite	march-hare cvs suite	eq	2009
march-hare:cvsnt	march-hare cvsnt	eq	2.0.58
march-hare:cvsnt	march-hare cvsnt	eq	2.5.01
march-hare:cvsnt	march-hare cvsnt	eq	2.5.02
march-hare:cvsnt	march-hare cvsnt	eq	2.5.03
march-hare:cvsnt	march-hare cvsnt	eq	2.5.04