medium4.3
CVE-2014-6276
Roundup sensitive data disclosure vulnerability
Impact
schema.py in Roundup before 1.5.1 does not properly limit attributes included in default user permissions, which might allow remote authenticated users to obtain sensitive user information by viewing user details.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| pip | roundup | < 1.5.1 | 1.5.1 |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Roundup-Tracker | Roundup | through 1.5.0 |
| Debian | Debian Linux | Versions 7.0, 8.0 |
Weakness classification
References
- NVD record
- CVE.org record
- GitHub advisory
- http://hg.code.sf.net/p/roundup/code/rev/a403c29ffaf9
- http://www.debian.org/security/2016/dsa-3502
- https://sourceforge.net/p/roundup/code/ci/tip/tree/CHANGES.txt
- https://github.com/advisories/GHSA-j556-q367-2gw6
- https://nvd.nist.gov/vuln/detail/CVE-2014-6276
- https://github.com/pypa/advisory-database/tree/main/vulns/roundup/PYSEC-2016-33.yaml