« Volver al listado

CVE-2010-1326

Estado: ModificadaAlta (9.3)—

perms.cpp in March Hare Software CVSNT 2.0.58, 2.5.01, 2.5.02, 2.5.03 before build 3736, 2.5.04 before build 2862; CVS Suite 2.5.03, 2008 before build 3736, and 2009 before 3729 allows remote attackers to bypass the permissions check, modify arbitrary modules and directories within CVSROOT, and execute arbitrary code via a crafted branch name ACL, possibly related to incorrect inheritance.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (2)

March-hare — CVS SuiteMarch-hare — Cvsnt

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2010-1326",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 9.3,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:M/Au:N/C:C/I:C/A:C",
          "authentication": "NONE",
          "integrityImpact": "COMPLETE",
          "accessComplexity": "MEDIUM",
          "availabilityImpact": "COMPLETE",
          "confidentialityImpact": "COMPLETE"
        },
        "acInsufInfo": false,
        "impactScore": 10,
        "baseSeverity": "HIGH",
        "obtainAllPrivilege": true,
        "exploitabilityScore": 8.6,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": false
      }
    ]
  },
  "affected": [
    {
      "source": "cve@mitre.org",
      "affectedData": [
        {
          "vendor": "n/a",
          "product": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ]
    }
  ],
  "published": "2010-09-15T18:00:03.353",
  "references": [
    {
      "url": "http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=593884",
      "source": "cve@mitre.org"
    },
    {
      "url": "http://customer.march-hare.com/webtools/bugzilla/attachment.cgi?tt=1&id=1790&action=view",
      "source": "cve@mitre.org"
    },
    {
      "url": "http://march-hare.com/cvspro/vuln.htm",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "cve@mitre.org"
    },
    {
      "url": "http://secunia.com/advisories/41345",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "cve@mitre.org"
    },
    {
      "url": "http://secunia.com/advisories/41358",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "cve@mitre.org"
    },
    {
      "url": "http://www.debian.org/security/2010/dsa-2108",
      "source": "cve@mitre.org"
    },
    {
      "url": "http://www.vupen.com/english/advisories/2010/2350",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "cve@mitre.org"
    },
    {
      "url": "http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=593884",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://customer.march-hare.com/webtools/bugzilla/attachment.cgi?tt=1&id=1790&action=view",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://march-hare.com/cvspro/vuln.htm",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://secunia.com/advisories/41345",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://secunia.com/advisories/41358",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.debian.org/security/2010/dsa-2108",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.vupen.com/english/advisories/2010/2350",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-264"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "perms.cpp in March Hare Software CVSNT 2.0.58, 2.5.01, 2.5.02, 2.5.03 before build 3736, 2.5.04 before build 2862; CVS Suite 2.5.03, 2008 before build 3736, and 2009 before 3729 allows remote attackers to bypass the permissions check, modify arbitrary modules and directories within CVSROOT, and execute arbitrary code via a crafted branch name ACL, possibly related to incorrect inheritance."
    },
    {
      "lang": "es",
      "value": "perms.cpp en March Hare Software CVSNT v2.0.58, v2.5.01, v2.5.02, v2.5.03 anterior a build 3736, v2.5.04 anterior a build 2862; CVS Suite v2.5.03, 2008 anterior a build 3736, and 2009 anterior a 3729 permite a los atacantes remotos evitar la verificación de permisos, modificar a su elección módulos y directorios dentro de CVSROOT, y ejecutar código a su elección a través de un nombre de ramificación ACL manipulada, posiblemente relacionadas con la herencia incorrecta."
    }
  ],
  "lastModified": "2026-06-16T23:18:08.417",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:march-hare:cvs_suite:2.5.03:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "1839DDE8-584F-40C4-A1DC-74D900EC0A3D"
            },
            {
              "criteria": "cpe:2.3:a:march-hare:cvs_suite:2008:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "CB493730-75A0-4918-9B58-E7B388BC36A9"
            },
            {
              "criteria": "cpe:2.3:a:march-hare:cvs_suite:2009:pre-release:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "153F0773-3470-4DE4-9FFA-6D99CB339AD5"
            },
            {
              "criteria": "cpe:2.3:a:march-hare:cvsnt:2.0.58:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "7A8DC576-0745-4246-BBE1-5C1539D3B9AA"
            },
            {
              "criteria": "cpe:2.3:a:march-hare:cvsnt:2.5.01:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "0AB51634-A1B3-48D9-97B6-596608B59891"
            },
            {
              "criteria": "cpe:2.3:a:march-hare:cvsnt:2.5.02:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "3AE04267-2249-4E12-A2E1-1C4D3B1F771D"
            },
            {
              "criteria": "cpe:2.3:a:march-hare:cvsnt:2.5.03:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "1736E671-6B48-4F02-BCBD-3B33694BF5EF"
            },
            {
              "criteria": "cpe:2.3:a:march-hare:cvsnt:2.5.04:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "56882D83-1ACC-414E-B446-DA7F7ECB7E03"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "cve@mitre.org"
}