CVE

Id
40172  
CVE No.
CVE-2009-2737  
Status
Candidate  
Description
The EditCSVAction function in cgi/actions.py in Roundup 1.2 before 1.2.1, 1.4 through 1.4.6, and possibly other versions does not properly check permissions, which allows remote authenticated users with edit or create privileges for a class to modify arbitrary items within that class, as demonstrated by editing all queries, modifying settings, and adding roles to users.  
Phase
Assigned (20090810)  
Votes
None (candidate not yet proposed)  
Comments
 

Actions

Related CVE References

Id CVE Id CVE No. Reference Actions
441729 40172 CVE-2009-2737 CONFIRM:http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=518768  View
441730 40172 CVE-2009-2737 CONFIRM:http://issues.roundup-tracker.org/issue2550521  View
441731 40172 CVE-2009-2737 CONFIRM:https://bugzilla.redhat.com/show_bug.cgi?id=489355  View
441732 40172 CVE-2009-2737 DEBIAN:DSA-1754  View
441733 40172 CVE-2009-2737 URL:http://www.debian.org/security/2009/dsa-1754  View
441734 40172 CVE-2009-2737 FEDORA:FEDORA-2009-2583  View
441735 40172 CVE-2009-2737 URL:https://www.redhat.com/archives/fedora-package-announce/2009-March/msg00429.html  View
441736 40172 CVE-2009-2737 FEDORA:FEDORA-2009-2591  View
441737 40172 CVE-2009-2737 URL:https://www.redhat.com/archives/fedora-package-announce/2009-March/msg00439.html  View
441738 40172 CVE-2009-2737 BID:34059  View
441739 40172 CVE-2009-2737 URL:http://www.securityfocus.com/bid/34059  View
441740 40172 CVE-2009-2737 OSVDB:56368  View
441741 40172 CVE-2009-2737 URL:http://www.osvdb.org/56368  View
441742 40172 CVE-2009-2737 SECUNIA:34192  View

Related JVN

Id JVN No. Title Summary CVE No. CVE Id CVSS_v2 CVSS_v3 JVN URL Actions
43861 JVNDB-2009-004868 IBM WebSphere Business Events の test サーブレットにおける任意のコードを実行される脆弱性 IBM WebSphere Business Events の test サーブレットの wberuntimeear アプリケーションには、任意のコードを実行される脆弱性が存在します。 CVE-2009-2741 40172 10 http://jvndb.jvn.jp/ja/contents/2009/JVNDB-2009-004868.html  View