GitHub Advisoryadvisory · PyPI

GHSA-j59j-h3g7-cpmf Roundup xml-rpc server improper check of property permissions

CRITICAL Published 2022-05-01 Modified 2025-04-09 Official page ↗
Aliases
CVE-2008-1475
Ecosystem
PyPI
Packages
roundup
Severity
Critical
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Weaknesses
CWE-284
Reviewed
2024-04-01

Affected packages

• PyPI roundup: < 1.4.5 → fixed in 1.4.5

Description

The xml-rpc server in Roundup 1.4.4 does not check property permissions, which allows attackers to bypass restrictions and edit or read restricted properties via the (1) list, (2) display, and (3) set methods.

Related

Alias · CVE (1)

  • CVE-2008-1475 The xml-rpc server in Roundup 1.4.4 does not check property permissions, which allows attackers to bypass restrictions and edit or read… vulnerability

Weakness · CWE (1)

  • CWE-284 Improper Access Control weakness

References