CVE-2008-4325: Medium severity viewvc ViewVC vulnerability

Published Sep 30, 2008

Updated

lib/viewvc.py in ViewVC 1.0.5 uses the content-type parameter in the HTTP request for the Content-Type header in the HTTP response, which allows remote attackers to cause content to be misinterpreted by the browser via a content-type parameter that is inconsistent with the requested object. NOTE: this issue might not be a vulnerability, since it requires attacker access to the repository that is being viewed.

Affected Software

1 affected component

viewvc ViewVC=1.0.5

Remediation

Patch Available

http://viewvc.tigris.org/issues/show_bug.cgi?id=354

Event History

Sep 30, 2008

CVE Published

via MITRE·04:00 PM

Data Sourced

via MITRE·04:00 PM

Description

Frequently Asked Questions

What is the severity of CVE-2008-4325?

CVE-2008-4325 has been classified as a medium severity vulnerability that can lead to content misinterpretation in a browser.

How do I fix CVE-2008-4325?

To fix CVE-2008-4325, upgrade ViewVC from version 1.0.5 to a patched version that eliminates the misuse of content-type parameters.

Which versions of ViewVC are affected by CVE-2008-4325?

CVE-2008-4325 specifically affects ViewVC version 1.0.5.

What type of attack does CVE-2008-4325 enable?

CVE-2008-4325 allows remote attackers to manipulate how the browser interprets content by exploiting the Content-Type header.

Is CVE-2008-4325 easy to exploit?

Yes, CVE-2008-4325 can be exploited easily due to its reliance on user-controlled content-type parameters.