CVE-2014-6276

schema.py in Roundup before 1.5.1 does not properly limit attributes included in default user permissions, which might allow remote authenticated users to obtain sensitive user information by viewing user details.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTNIST
4.3 MEDIUM
NETWORK
LOW
LOW
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
debianCNA
---
---
CVEADP
---
---
Base Score
CVSS 3.x
EPSS Score
Percentile: 33%
VendorProductVersion
roundup-trackerroundup
𝑥
≤ 1.5.0
debiandebian_linux
7.0
debiandebian_linux
8.0
𝑥
= Vulnerable software versions
Ubuntu logo
Ubuntu Releases
Ubuntu Product
Codename
roundup
zesty
dne
yakkety
dne
xenial
Fixed 1.4.20-1.1+deb8u1build0.16.04.1
released
wily
Fixed 1.4.20-1.1+deb8u1build0.15.10.1
released
trusty
Fixed 1.4.20-1.1+deb8u1build0.14.04.1
released
precise
ignored
Common Weakness Enumeration
References
http://hg.code.sf.net/p/roundup/code/rev/a403c29ffaf9
http://www.debian.org/security/2016/dsa-3502
https://sourceforge.net/p/roundup/code/ci/tip/tree/CHANGES.txt
http://hg.code.sf.net/p/roundup/code/rev/a403c29ffaf9
http://www.debian.org/security/2016/dsa-3502
https://sourceforge.net/p/roundup/code/ci/tip/tree/CHANGES.txt