Medium severity · published Mar 29, 2018
CVE-2014-5028
The Original File and Patched File resources in Review Board 1.7.x before 1.7.27 and 2.0.x before 2.0.4 allow remote authenticated users to bypass intended access restrictions and…
6.5
CVSS
1.6%
EPSS
No
On KEV
Description
The Original File and Patched File resources in Review Board 1.7.x before 1.7.27 and 2.0.x before 2.0.4 allow remote authenticated users to bypass intended access restrictions and obtain sensitive information from repository files by leveraging knowledge of database ids.
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)1.6% · higher than 76% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
RB
Review Board · Reviewboard
after 1.7.0 before 1.7.27; 2.0 before 2.0.4 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2014-5028
CVE.org
https://www.cve.org/CVERecord?id=CVE-2014-5028
Mailing List
http://www.openwall.com/lists/oss-security/2014/07/22/12
Issue Tracking
https://bugzilla.redhat.com/show_bug.cgi?id=1123692
Third Party Advisory
https://exchange.xforce.ibmcloud.com/vulnerabilities/94813
Vendor Advisory
https://www.reviewboard.org/docs/releasenotes/reviewboard/1.7.27
Vendor Advisory
https://www.reviewboard.org/docs/releasenotes/reviewboard/2.0.4
Vendor Advisory
https://www.reviewboard.org/news/2014/07/22/review-board-1-7-27-and-2-0-3-security-releases
More from Review Board
9.8
CVE-2013-4409
An eval() vulnerability exists in Python Software Foundation Djblets 0.7.21 and Beanbag Review Board before 1.7.15 when parsing JSON requests
5.4
CVE-2021-31330
A Cross-Site Scripting (XSS) vulnerability exists within Review Board versions 3.0.20 and 4.0 RC1 and earlier
–
CVE-2014-5027
Cross-site scripting (XSS) vulnerability in Review Board 1.7.x before 1.7.27 and 2.0.x before 2.0.4 allows remote attackers to inject arbitrary web script or HTML via a query…
–
CVE-2013-4795
Cross-site scripting (XSS) vulnerability in the Submitters list in Review Board 1.6.x before 1.6.18 and 1.7.x before 1.7.12 allows remote attackers to inject arbitrary web script…
–
CVE-2013-4519
Multiple cross-site scripting (XSS) vulnerabilities in Review Board 1.6.x before 1.6.21 and 1.7.x before 1.7.17 allow remote attackers to inject arbitrary web script or HTML via…