CVE-2008-1292: Infoleak

Published Mar 24, 2008

Updated

ViewVC before 1.0.5 provides revision metadata without properly checking whether access was intended, which allows remote attackers to obtain sensitive information by reading (1) forbidden pathnames in the revision view, (2) log history that can only be reached by traversing a forbidden object, or (3) forbidden diff view path parameters.

Affected Software

5 affected components

Gentoo Linux

redhat Fedora=7

redhat Fedora=8

viewvc ViewVC=1.0.2

viewvc ViewVC=1.0.3

Remediation

Patch Available

http://www.securityfocus.com/bid/28055

Event History

Mar 24, 2008

CVE Published

via MITRE·05:00 PM

Data Sourced

via MITRE·05:00 PM

Description

Data Sourced

05:44 PM

DescriptionWeaknessAffected Software

Frequently Asked Questions

What is the severity of CVE-2008-1292?

CVE-2008-1292 is considered a high-severity vulnerability due to its potential to expose sensitive repository information.

How do I fix CVE-2008-1292?

To fix CVE-2008-1292, upgrade ViewVC to version 1.0.5 or later to ensure proper access controls are in place.

Which versions of ViewVC are affected by CVE-2008-1292?

CVE-2008-1292 affects ViewVC versions 1.0.2 and 1.0.3.

What types of sensitive information can be exposed by CVE-2008-1292?

CVE-2008-1292 can expose forbidden pathnames and log history that should not be accessible.

Is CVE-2008-1292 specific to any operating systems?

While CVE-2008-1292 primarily affects ViewVC software, it has been reported in conjunction with various operating systems, including Fedora.