CVE-2008-1475
published 2008-03-24CVE-2008-1475: The xml-rpc server in Roundup 1.4.4 does not check property permissions, which allows attackers to bypass restrictions and edit or read restricted properties…
PriorityP425medium6.4CVSS 2.0
AVNACLAuNCPIPAN
EPSS
1.74%
74.9th percentile
The xml-rpc server in Roundup 1.4.4 does not check property permissions, which allows attackers to bypass restrictions and edit or read restricted properties via the (1) list, (2) display, and (3) set methods.
Affected
77 ranges· showing 25
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| roundup-tracker | roundup | <= 1.4.3 | — |
| roundup-tracker | roundup | — | — |
| roundup-tracker | roundup | — | — |
| roundup-tracker | roundup | — | — |
| roundup-tracker | roundup | — | — |
| roundup-tracker | roundup | — | — |
| roundup-tracker | roundup | — | — |
| roundup-tracker | roundup | — | — |
| roundup-tracker | roundup | — | — |
| roundup-tracker | roundup | — | — |
| roundup-tracker | roundup | — | — |
| roundup-tracker | roundup | — | — |
| roundup-tracker | roundup | — | — |
| roundup-tracker | roundup | — | — |
| roundup-tracker | roundup | — | — |
| roundup-tracker | roundup | — | — |
| roundup-tracker | roundup | — | — |
| roundup-tracker | roundup | — | — |
| roundup-tracker | roundup | — | — |
| roundup-tracker | roundup | — | — |
| roundup-tracker | roundup | — | — |
| roundup-tracker | roundup | — | — |
| roundup-tracker | roundup | — | — |
| roundup-tracker | roundup | — | — |
| roundup-tracker | roundup | — | — |
CVSS provenance
nvdv2.06.4MEDIUMAV:N/AC:L/Au:N/C:P/I:P/A:N
vendor_redhat6.4MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Red Hat
roundup: xmlrpc-server not checking property permissions
vendor_redhat·CVSS 6.4
CVE-2008-1475 [MEDIUM] roundup: xmlrpc-server not checking property permissions
roundup: xmlrpc-server not checking property permissions
The xml-rpc server in Roundup 1.4.4 does not check property permissions, which allows attackers to bypass restrictions and edit or read restricted properties via the (1) list, (2) display, and (3) set methods.
OSV
Roundup xml-rpc server improper check of property permissions
osv·2022-05-01
CVE-2008-1475 [CRITICAL] Roundup xml-rpc server improper check of property permissions
Roundup xml-rpc server improper check of property permissions
The xml-rpc server in Roundup 1.4.4 does not check property permissions, which allows attackers to bypass restrictions and edit or read restricted properties via the (1) list, (2) display, and (3) set methods.
GHSA
Roundup xml-rpc server improper check of property permissions
ghsa·2022-05-01
CVE-2008-1475 [CRITICAL] CWE-284 Roundup xml-rpc server improper check of property permissions
Roundup xml-rpc server improper check of property permissions
The xml-rpc server in Roundup 1.4.4 does not check property permissions, which allows attackers to bypass restrictions and edit or read restricted properties via the (1) list, (2) display, and (3) set methods.
OSV
CVE-2008-1475: The xml-rpc server in Roundup 1
osv·2008-03-24
CVE-2008-1475 CVE-2008-1475: The xml-rpc server in Roundup 1
The xml-rpc server in Roundup 1.4.4 does not check property permissions, which allows attackers to bypass restrictions and edit or read restricted properties via the (1) list, (2) display, and (3) set methods.
No detection rules found.
http://secunia.com/advisories/29336http://secunia.com/advisories/29375http://secunia.com/advisories/30274http://secunia.com/advisories/32805http://security.gentoo.org/glsa/glsa-200805-21.xmlhttp://sourceforge.net/tracker/index.php?func=detail&aid=1907211&group_id=31577&atid=402788http://www.securityfocus.com/bid/28238http://www.vupen.com/english/advisories/2008/0891https://bugzilla.redhat.com/show_bug.cgi?id=436546https://exchange.xforce.ibmcloud.com/vulnerabilities/41240https://www.redhat.com/archives/fedora-package-announce/2008-March/msg00264.htmlhttps://www.redhat.com/archives/fedora-package-announce/2008-March/msg00375.htmlhttps://www.redhat.com/archives/fedora-package-announce/2008-November/msg00452.htmlhttps://www.redhat.com/archives/fedora-package-announce/2008-November/msg00478.htmlhttp://secunia.com/advisories/29336http://secunia.com/advisories/29375http://secunia.com/advisories/30274http://secunia.com/advisories/32805http://security.gentoo.org/glsa/glsa-200805-21.xmlhttp://sourceforge.net/tracker/index.php?func=detail&aid=1907211&group_id=31577&atid=402788http://www.securityfocus.com/bid/28238http://www.vupen.com/english/advisories/2008/0891https://bugzilla.redhat.com/show_bug.cgi?id=436546https://exchange.xforce.ibmcloud.com/vulnerabilities/41240https://www.redhat.com/archives/fedora-package-announce/2008-March/msg00264.htmlhttps://www.redhat.com/archives/fedora-package-announce/2008-March/msg00375.htmlhttps://www.redhat.com/archives/fedora-package-announce/2008-November/msg00452.htmlhttps://www.redhat.com/archives/fedora-package-announce/2008-November/msg00478.html
2008-03-24
Published