VDB
CVE-2008-1475
CVE-2008-1475
PUBLISHED
CVSS 9.100000381469727 CRITICAL
The xml-rpc server in Roundup 1.4.4 does not check property permissions, which allows attackers to bypass restrictions and edit or read restricted properties via the (1) list, (2) display, and (3) set methods.
EPSS 1.76% · 77.6th percentile
Risk Scores
CVSS 3.1
9.100000381469727
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
EPSS Score
1.76%
77.6th percentile
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| n/a | n/a | n/a |
| roundup-tracker | roundup | 0, 0.1.0, 0.3.0 |
| PyPI | roundup | 0 |
Timeline
- Mar 24, 2008 CVE Published
- Feb 4, 2022 EPSS Score
- Mar 29, 2022 EPSS Score
- May 21, 2022 EPSS Score
- Sep 6, 2022 EPSS Score
- Oct 29, 2022 EPSS Score
- Dec 21, 2022 EPSS Score
- Feb 13, 2023 EPSS Score
- Apr 7, 2023 EPSS Score
- May 30, 2023 EPSS Score
- Jul 22, 2023 EPSS Score
- Sep 14, 2023 EPSS Score
References
- 30274 third-party-advisory
- FEDORA-2008-9734 vendor-advisory
- GLSA-200805-21 vendor-advisory
- http://sourceforge.net/tracker/index.php?func=detail&aid=1907211&group_id=31577&atid=402788 url
- FEDORA-2008-2471 vendor-advisory
- 29375 third-party-advisory
- roundup-xmlrpc-security-bypass(41240) vdb
- ADV-2008-0891 vdb
- 28238 vdb
- 29336 third-party-advisory
- FEDORA-2008-9712 vendor-advisory
- FEDORA-2008-2370 vendor-advisory
- 32805 third-party-advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=436546 url
- https://nvd.nist.gov/vuln/detail/CVE-2008-1475 advisory
- https://github.com/roundup-tracker/roundup/commit/c00b7e5801f8baa246fa76b4aad5287882310189 url
- https://github.com/pypa/advisory-database/tree/main/vulns/roundup/PYSEC-2008-10.yaml url
- https://github.com/roundup-tracker/roundup package
- http://www.redhat.com/archives/fedora-package-announce/2008-March/msg00264.html url
- http://www.redhat.com/archives/fedora-package-announce/2008-March/msg00375.html url
…and 2 more