CVE-2010-0004: Infoleak
Published Jan 29, 2010
·Updated
ViewVC before 1.1.3 composes the root listing view without using the authorizer for each root, which might allow remote attackers to discover private root names by reading this view.
Affected Software
11 affected components
viewvc ViewVC=1.0.1
viewvc ViewVC=1.0.2
viewvc ViewVC=1.0.3
viewvc ViewVC=1.0.4
viewvc ViewVC=1.0.5
viewvc ViewVC=1.0.6
viewvc ViewVC=1.0.7
viewvc ViewVC=1.0.8
viewvc ViewVC=1.1.0
viewvc ViewVC=1.1.1
viewvc ViewVC=1.1.2
Event History
Jan 29, 2010
CVE Published
via MITRE·06:00 PM
Data Sourced
via MITRE·06:00 PM
Description
Data Sourced
via NVD·06:30 PM
DescriptionSeverityWeaknessAffected Software
Frequently Asked Questions
1
What is the severity of CVE-2010-0004?
CVE-2010-0004 is considered a moderate severity vulnerability due to its potential to expose private root names.
2
How do I fix CVE-2010-0004?
To fix CVE-2010-0004, upgrade ViewVC to version 1.1.3 or later.
3
What versions of ViewVC are affected by CVE-2010-0004?
ViewVC versions 1.0.1 through 1.1.2 are affected by CVE-2010-0004.
4
What type of attack can exploit CVE-2010-0004?
CVE-2010-0004 can be exploited by remote attackers to discover private root names.
5
Is CVE-2010-0004 related to authentication issues?
Yes, CVE-2010-0004 arises from the failure to use the proper authorizer for each root in ViewVC.