critical10.0
CVE-2007-1406
Trac missing Content-Disposition HTTP header
Impact
Trac before 0.10.3.1 does not send a Content-Disposition HTTP header specifying an attachment in certain "unsafe" situations, which has unknown impact and remote attack vectors.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| pip | trac | < 0.10.3.1 | 0.10.3.1 |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Edgewall Software | Trac | Versions 0.10, 0.10.1, 0.10.2, 0.10.3 |