GitHub Advisoryadvisory · PyPI

GHSA-j556-q367-2gw6 Roundup sensitive data disclosure vulnerability

MEDIUM Published 2022-05-17 Modified 2024-10-26 Official page ↗
Aliases
CVE-2014-6276
Ecosystem
PyPI
Packages
roundup
Severity
Moderate
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Weaknesses
CWE-200
Reviewed
2023-08-16

Affected packages

• PyPI roundup: < 1.5.1 → fixed in 1.5.1

Description

schema.py in Roundup before 1.5.1 does not properly limit attributes included in default user permissions, which might allow remote authenticated users to obtain sensitive user information by viewing user details.

Related

Alias · CVE (1)

  • CVE-2014-6276 schema.py in Roundup before 1.5.1 does not properly limit attributes included in default user permissions, which might allow remote… vulnerability

Weakness · CWE (1)

  • CWE-200 Exposure of Sensitive Information to an Unauthorized Actor weakness

References