Unscored severity · published Jan 29, 2010
CVE-2010-0004
ViewVC before 1.1.3 composes the root listing view without using the authorizer for each root, which might allow remote attackers to discover private root names by reading this…
–
CVSS
2.6%
EPSS
No
On KEV
Description
ViewVC before 1.1.3 composes the root listing view without using the authorizer for each root, which might allow remote attackers to discover private root names by reading this view.
Exploitation
Is it being used?
Exploit prediction (EPSS)2.6% · higher than 85% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
VI
Viewvc · Viewvc
1.0.1; 1.0.2; 1.0.3; 1.0.4; 1.0.5; 1.0.6; +5 more · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2010-0004
CVE.org
https://www.cve.org/CVERecord?id=CVE-2010-0004
lists.opensuse.org
http://lists.opensuse.org/opensuse-security-announce/2010-01/msg00009.html
viewvc.tigris.org
http://viewvc.tigris.org/source/browse/%2Acheckout%2A/viewvc/trunk/docs/release-notes/1.1.0.html?revision=2222
viewvc.tigris.org
http://viewvc.tigris.org/source/browse/viewvc/trunk/CHANGES?r1=2242&r2=2313&pathrev=HEAD
viewvc.tigris.org
http://viewvc.tigris.org/source/browse/viewvc?view=rev&revision=2300
www.openwall.com
http://www.openwall.com/lists/oss-security/2010/01/11/2
www.openwall.com
http://www.openwall.com/lists/oss-security/2010/01/13/5
More from Viewvc
7.5
CVE-2025-54141
ViewVC is a browser interface for CVS and Subversion version control repositories
7.5
CVE-2007-5743
viewvc 1.0.3 allows improper access control to files in a repository when using the "forbidden" configuration option
6.1
CVE-2023-22456
ViewVC, a browser interface for CVS and Subversion version control repositories, as a cross-site scripting vulnerability that affects versions prior to 1.2.2 and 1.1.29
6.1
CVE-2017-5938
Cross-site scripting (XSS) vulnerability in the nav_path function in lib/viewvc.py in ViewVC before 1.0.14 and 1.1.x before 1.1.26 allows remote attackers to inject arbitrary web…
5.4
CVE-2023-22464
ViewVC is a browser interface for CVS and Subversion version control repositories