CVE-2009-2737

{"id": "CVE-2009-2737", "cveTags": [], "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 5.5, "accessVector": "NETWORK", "vectorString": "AV:N/AC:L/Au:S/C:N/I:P/A:P", "authentication": "SINGLE", "integrityImpact": "PARTIAL", "accessComplexity": "LOW", "availabilityImpact": "PARTIAL", "confidentialityImpact": "NONE"}, "acInsufInfo": false, "impactScore": 4.9, "baseSeverity": "MEDIUM", "obtainAllPrivilege": false, "exploitabilityScore": 8.0, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}]}, "published": "2009-08-11T10:30:00.670", "references": [{"url": "http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=518768", "source": "cve@mitre.org"}, {"url": "http://issues.roundup-tracker.org/issue2550521", "source": "cve@mitre.org"}, {"url": "http://secunia.com/advisories/34192", "tags": ["Vendor Advisory"], "source": "cve@mitre.org"}, {"url": "http://www.debian.org/security/2009/dsa-1754", "tags": ["Patch"], "source": "cve@mitre.org"}, {"url": "http://www.osvdb.org/56368", "source": "cve@mitre.org"}, {"url": "http://www.securityfocus.com/bid/34059", "source": "cve@mitre.org"}, {"url": "https://bugzilla.redhat.com/show_bug.cgi?id=489355", "source": "cve@mitre.org"}, {"url": "https://www.redhat.com/archives/fedora-package-announce/2009-March/msg00429.html", "source": "cve@mitre.org"}, {"url": "https://www.redhat.com/archives/fedora-package-announce/2009-March/msg00439.html", "source": "cve@mitre.org"}, {"url": "http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=518768", "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "http://issues.roundup-tracker.org/issue2550521", "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "http://secunia.com/advisories/34192", "tags": ["Vendor Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "http://www.debian.org/security/2009/dsa-1754", "tags": ["Patch"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "http://www.osvdb.org/56368", "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "http://www.securityfocus.com/bid/34059", "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://bugzilla.redhat.com/show_bug.cgi?id=489355", "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://www.redhat.com/archives/fedora-package-announce/2009-March/msg00429.html", "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://www.redhat.com/archives/fedora-package-announce/2009-March/msg00439.html", "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-264"}]}], "descriptions": [{"lang": "en", "value": "The EditCSVAction function in cgi/actions.py in Roundup 1.2 before 1.2.1, 1.4 through 1.4.6, and possibly other versions does not properly check permissions, which allows remote authenticated users with edit or create privileges for a class to modify arbitrary items within that class, as demonstrated by editing all queries, modifying settings, and adding roles to users."}, {"lang": "es", "value": "La funci\u00f3n EditCSVAction en cgi/actions.py en Roundup v1.2 anteriores a v1.2.1, v1.4 hasta v1.4.6, y posiblemente otras versiones no verifica adecuadamente los permisos, permitiendo a usuarios autenticados remotamente con privilegios de edici\u00f3n o creaci\u00f3n en una clase modificar elementos de su elecci\u00f3n con esa clase, como se ha demostrado al editar todas las consultas, modificar la configuraci\u00f3n y a\u00f1adir roles a los usuarios."}], "lastModified": "2025-04-09T00:30:58.490", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:toni_mueller:roundup:1.2.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "56733697-252E-46D4-9D1E-592EA9B07946"}, {"criteria": "cpe:2.3:a:toni_mueller:roundup:1.4.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "B77E0664-DD8A-416B-A634-D20400699106"}, {"criteria": "cpe:2.3:a:toni_mueller:roundup:1.4.1:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "2841E10E-228B-4D0E-841A-73B19ECF1113"}, {"criteria": "cpe:2.3:a:toni_mueller:roundup:1.4.2:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "21E28655-E926-4DA1-B447-3A04733C326C"}, {"criteria": "cpe:2.3:a:toni_mueller:roundup:1.4.3:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "82AED6E0-89EB-4C27-AA82-D256D5FDBADE"}, {"criteria": "cpe:2.3:a:toni_mueller:roundup:1.4.4:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "44789245-3D9B-444C-921A-BF0E8E8002FD"}, {"criteria": "cpe:2.3:a:toni_mueller:roundup:1.4.5:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "12164E11-5161-4CD5-9F0E-D4E496733F37"}, {"criteria": "cpe:2.3:a:toni_mueller:roundup:1.4.6:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "424BBB10-A647-4B09-A838-5F4A05718B00"}], "operator": "OR"}]}], "sourceIdentifier": "cve@mitre.org"}