Unscored severity · published Mar 24, 2008
CVE-2008-1292
ViewVC before 1.0.5 provides revision metadata without properly checking whether access was intended, which allows remote attackers to obtain sensitive information by reading (1)…
–
CVSS
1.4%
EPSS
No
On KEV
Description
ViewVC before 1.0.5 provides revision metadata without properly checking whether access was intended, which allows remote attackers to obtain sensitive information by reading (1) forbidden pathnames in the revision view, (2) log history that can only be reached by traversing a forbidden object, or (3) forbidden diff view path parameters.
Exploitation
Is it being used?
Exploit prediction (EPSS)1.4% · higher than 72% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
VI
Viewvc · Viewvc
1.0.2; 1.0.3 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2008-1292
CVE.org
https://www.cve.org/CVERecord?id=CVE-2008-1292
bugs.debian.org
http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=471380
bugs.gentoo.org
http://bugs.gentoo.org/show_bug.cgi?id=212288
Vendor Advisory
http://secunia.com/advisories/29176
Vendor Advisory
http://secunia.com/advisories/29460
security.gentoo.org
http://security.gentoo.org/glsa/glsa-200803-29.xml
viewvc.tigris.org
http://viewvc.tigris.org/source/browse/viewvc/trunk/CHANGES?rev=HEAD
More from Viewvc
7.5
CVE-2025-54141
ViewVC's standalone server exposes arbitrary server filesystem content
7.5
CVE-2007-5743
viewvc 1.0.3 allows improper access control to files in a repository when using the "forbidden" configuration option
6.1
CVE-2023-22456
ViewVC, a browser interface for CVS and Subversion version control repositories, as a cross-site scripting vulnerability that affects versions prior to 1.2.2 and 1.1.29
6.1
CVE-2017-5938
Cross-site scripting (XSS) vulnerability in the nav_path function in lib/viewvc.py in ViewVC before 1.0.14 and 1.1.x before 1.1.26 allows remote attackers to inject arbitrary web…
5.4
CVE-2023-22464
ViewVC is a browser interface for CVS and Subversion version control repositories