CVE-2014-6276

EUVD-2016-0031
schema.py in Roundup before 1.5.1 does not properly limit attributes included in default user permissions, which might allow remote authenticated users to obtain sensitive user information by viewing user details.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
4.3 MEDIUM
NETWORK
LOW
LOW
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Base Score
CVSS 3.x
EPSS Score
Percentile: 32%
Affected Products (NVD)
VendorProductVersion
roundup-trackerroundup
𝑥
≤ 1.5.0
debiandebian_linux
7.0
debiandebian_linux
8.0
𝑥
= Vulnerable software versions
Ubuntu logo
Ubuntu Releases
Ubuntu Product
Codename
roundup
precise
ignored
trusty
Fixed 1.4.20-1.1+deb8u1build0.14.04.1
released
wily
Fixed 1.4.20-1.1+deb8u1build0.15.10.1
released
xenial
Fixed 1.4.20-1.1+deb8u1build0.16.04.1
released
yakkety
dne
zesty
dne
Common Weakness Enumeration
References
http://hg.code.sf.net/p/roundup/code/rev/a403c29ffaf9
http://www.debian.org/security/2016/dsa-3502
https://sourceforge.net/p/roundup/code/ci/tip/tree/CHANGES.txt
http://hg.code.sf.net/p/roundup/code/rev/a403c29ffaf9
http://www.debian.org/security/2016/dsa-3502
https://sourceforge.net/p/roundup/code/ci/tip/tree/CHANGES.txt