Description
ViewVC before 1.1.3 composes the root listing view without using the authorizer for each root, which might allow remote attackers to discover private root names by reading this view.
References
- http://viewvc.tigris.org/source/browse/viewvc/trunk/CHANGES?r1=2242&r2=2313&pathrev=HEAD
- FEDORA-2009-13610 vendor-advisory
- [oss-security] 20100113 Re: CVE Request: viewvc mailing-list
- FEDORA-2009-13634 vendor-advisory
- [oss-security] 20100111 CVE Request: viewvc mailing-list
- http://viewvc.tigris.org/source/browse/%2Acheckout%2A/viewvc/trunk/docs/release-notes/1.1.0.html?revision=2222
- [oss-security] 20100114 Re: CVE Request: viewvc mailing-list
- SUSE-SA:2010:008 vendor-advisory
- http://viewvc.tigris.org/source/browse/viewvc?view=rev&revision=2300