Description
query.py in the query interface in ViewVC before 1.1.3 does not reject configurations that specify an unsupported authorizer for a root, which might allow remote attackers to bypass intended access restrictions via a query.
References
- http://viewvc.tigris.org/source/browse/viewvc/trunk/CHANGES?r1=2242&r2=2313&pathrev=HEAD
- FEDORA-2009-13610 vendor-advisory
- [oss-security] 20100113 Re: CVE Request: viewvc mailing-list
- FEDORA-2009-13634 vendor-advisory
- [oss-security] 20100111 CVE Request: viewvc mailing-list
- SUSE-SA:2010:008 vendor-advisory
- http://viewvc.tigris.org/source/browse/viewvc?view=rev&revision=2300