Unscored severity · published Mar 24, 2008
CVE-2008-1291
ViewVC before 1.0.5 stores sensitive information under the web root with insufficient access control, which allows remote attackers to read files and list folders under the hidden…
–
CVSS
1.4%
EPSS
No
On KEV
Description
ViewVC before 1.0.5 stores sensitive information under the web root with insufficient access control, which allows remote attackers to read files and list folders under the hidden CVSROOT folder.
Exploitation
Is it being used?
Exploit prediction (EPSS)1.4% · higher than 72% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
VI
Viewvc · Viewvc
1.0.2; 1.0.3 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2008-1291
CVE.org
https://www.cve.org/CVERecord?id=CVE-2008-1291
bugs.debian.org
http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=471380
bugs.gentoo.org
http://bugs.gentoo.org/show_bug.cgi?id=212288
Vendor Advisory
http://secunia.com/advisories/29176
Vendor Advisory
http://secunia.com/advisories/29460
security.gentoo.org
http://security.gentoo.org/glsa/glsa-200803-29.xml
viewvc.tigris.org
http://viewvc.tigris.org/source/browse/viewvc/trunk/CHANGES?rev=HEAD
More from Viewvc
7.5
CVE-2025-54141
ViewVC is a browser interface for CVS and Subversion version control repositories
7.5
CVE-2007-5743
viewvc 1.0.3 allows improper access control to files in a repository when using the "forbidden" configuration option
6.1
CVE-2023-22456
ViewVC, a browser interface for CVS and Subversion version control repositories, as a cross-site scripting vulnerability that affects versions prior to 1.2.2 and 1.1.29
6.1
CVE-2017-5938
Cross-site scripting (XSS) vulnerability in the nav_path function in lib/viewvc.py in ViewVC before 1.0.14 and 1.1.x before 1.1.26 allows remote attackers to inject arbitrary web…
5.4
CVE-2023-22464
ViewVC is a browser interface for CVS and Subversion version control repositories