« Back to list

CVE-2010-0004

Status: ModifiedMedium (5)—

ViewVC before 1.1.3 composes the root listing view without using the authorizer for each root, which might allow remote attackers to discover private root names by reading this view.

CVSS

Exploitation probability (EPSS)

EPSS (Exploit Prediction Scoring System, FIRST) estimates how likely a vulnerability is to be exploited in the wild within 30 days. It complements CVSS (impact) and CISA KEV (confirmed exploitation).

Affected technologies (1)

Viewvc — Viewvc

CWEs

References

Raw JSON (NVD)

Show
{
  "id": "CVE-2010-0004",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 5,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:N",
          "authentication": "NONE",
          "integrityImpact": "NONE",
          "accessComplexity": "LOW",
          "availabilityImpact": "NONE",
          "confidentialityImpact": "PARTIAL"
        },
        "acInsufInfo": false,
        "impactScore": 2.9,
        "baseSeverity": "MEDIUM",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 10,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": false
      }
    ]
  },
  "affected": [
    {
      "source": "secalert@redhat.com",
      "affectedData": [
        {
          "vendor": "n/a",
          "product": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ]
    }
  ],
  "published": "2010-01-29T18:30:00.997",
  "references": [
    {
      "url": "http://lists.opensuse.org/opensuse-security-announce/2010-01/msg00009.html",
      "source": "secalert@redhat.com"
    },
    {
      "url": "http://viewvc.tigris.org/source/browse/%2Acheckout%2A/viewvc/trunk/docs/release-notes/1.1.0.html?revision=2222",
      "source": "secalert@redhat.com"
    },
    {
      "url": "http://viewvc.tigris.org/source/browse/viewvc/trunk/CHANGES?r1=2242&r2=2313&pathrev=HEAD",
      "source": "secalert@redhat.com"
    },
    {
      "url": "http://viewvc.tigris.org/source/browse/viewvc?view=rev&revision=2300",
      "source": "secalert@redhat.com"
    },
    {
      "url": "http://www.openwall.com/lists/oss-security/2010/01/11/2",
      "source": "secalert@redhat.com"
    },
    {
      "url": "http://www.openwall.com/lists/oss-security/2010/01/13/5",
      "source": "secalert@redhat.com"
    },
    {
      "url": "http://www.openwall.com/lists/oss-security/2010/01/14/4",
      "source": "secalert@redhat.com"
    },
    {
      "url": "https://www.redhat.com/archives/fedora-package-announce/2009-December/msg01421.html",
      "source": "secalert@redhat.com"
    },
    {
      "url": "https://www.redhat.com/archives/fedora-package-announce/2009-December/msg01464.html",
      "source": "secalert@redhat.com"
    },
    {
      "url": "http://lists.opensuse.org/opensuse-security-announce/2010-01/msg00009.html",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://viewvc.tigris.org/source/browse/%2Acheckout%2A/viewvc/trunk/docs/release-notes/1.1.0.html?revision=2222",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://viewvc.tigris.org/source/browse/viewvc/trunk/CHANGES?r1=2242&r2=2313&pathrev=HEAD",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://viewvc.tigris.org/source/browse/viewvc?view=rev&revision=2300",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.openwall.com/lists/oss-security/2010/01/11/2",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.openwall.com/lists/oss-security/2010/01/13/5",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.openwall.com/lists/oss-security/2010/01/14/4",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://www.redhat.com/archives/fedora-package-announce/2009-December/msg01421.html",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://www.redhat.com/archives/fedora-package-announce/2009-December/msg01464.html",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-200"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "ViewVC before 1.1.3 composes the root listing view without using the authorizer for each root, which might allow remote attackers to discover private root names by reading this view."
    },
    {
      "lang": "es",
      "value": "ViewVc anterior a v1.1.3, compone la vista del listado root sin emplear la autorización para cada root, lo que podría permitir a atcantes remotos descubrir los nombres privados de root leyendo esta vista."
    }
  ],
  "lastModified": "2026-06-16T23:15:12.377",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:viewvc:viewvc:1.0.1:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "007977CF-1BF9-4713-AFDF-50DEE2530AD5"
            },
            {
              "criteria": "cpe:2.3:a:viewvc:viewvc:1.0.2:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "793F6DB3-A6C2-4813-BD2D-AF34D85F6CCA"
            },
            {
              "criteria": "cpe:2.3:a:viewvc:viewvc:1.0.3:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "1B6F2BC5-D099-427C-9513-75551ABF1997"
            },
            {
              "criteria": "cpe:2.3:a:viewvc:viewvc:1.0.4:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "4748AA05-D2ED-4365-83AE-74CD33592B5D"
            },
            {
              "criteria": "cpe:2.3:a:viewvc:viewvc:1.0.5:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "91ADB624-1826-405C-BB1E-3D286ED03D5A"
            },
            {
              "criteria": "cpe:2.3:a:viewvc:viewvc:1.0.6:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "A4AE31C7-1929-48A4-8A3A-860A110E4820"
            },
            {
              "criteria": "cpe:2.3:a:viewvc:viewvc:1.0.7:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "F71721BF-9010-4595-96F8-CF499B0FFE6D"
            },
            {
              "criteria": "cpe:2.3:a:viewvc:viewvc:1.0.8:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "96AD0DD2-206B-4231-B09E-9B83F6E0239E"
            },
            {
              "criteria": "cpe:2.3:a:viewvc:viewvc:1.1.0:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "8ECD4F7E-011C-4E92-9D8E-AC378B204C05"
            },
            {
              "criteria": "cpe:2.3:a:viewvc:viewvc:1.1.1:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "4FE78493-E4EB-4555-BA56-A29AFE680B56"
            },
            {
              "criteria": "cpe:2.3:a:viewvc:viewvc:1.1.2:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "C076220E-CFB1-44B0-9884-840F4C5B4F9A"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "secalert@redhat.com"
}