CVEvulnerability
CVE-2014-6276
4.3 MEDIUM
Official page ↗
- Status
- Modified
- Published
- 2016-04-13
- Last modified
- 2026-06-17
- Assigner
- [email protected]
- CVSS 3.0 ([email protected])
- 4.3 MEDIUM — CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
- CVSS 2.0 ([email protected])
- 4.0 MEDIUM — AV:N/AC:L/Au:S/C:P/I:N/A:N
- Weaknesses
- CWE-264
Description
schema.py in Roundup before 1.5.1 does not properly limit attributes included in default user permissions, which might allow remote authenticated users to obtain sensitive user information by viewing user details.
Affected configurations
• roundup-tracker roundup (<= 1.5.0)
• debian debian linux 7.0
• debian debian linux 8.0
Related
Weakness · not in database (1)
References
- http://hg.code.sf.net/p/roundup/code/rev/a403c29ffaf9 hg.code.sf.net
- http://www.debian.org/security/2016/dsa-3502 www.debian.org
- https://sourceforge.net/p/roundup/code/ci/tip/tree/CHANGES.txt Patch
- http://hg.code.sf.net/p/roundup/code/rev/a403c29ffaf9 hg.code.sf.net
- http://www.debian.org/security/2016/dsa-3502 www.debian.org
- https://sourceforge.net/p/roundup/code/ci/tip/tree/CHANGES.txt Patch