Main Vulnerability Database Vulnerabilities #VU35070

Incorrect default permissions in Trac and Debian Linux - CVE-2010-5108

Published: November 14, 2019 / Updated: August 8, 2020

Vulnerability identifier: #VU35070

CSH Severity: Medium

CVSS v4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N]

CVE-ID: CVE-2010-5108

CWE-ID: CWE-276

Exploitation vector: Remote access

Exploit availability: No public exploit available

Vulnerability details

The vulnerability allows a remote non-authenticated attacker to manipulate data.

Trac 0.11.6 does not properly check workflow permissions before modifying a ticket. This can be exploited by an attacker to change the status and resolution of tickets without having proper permissions.

Affected software

Trac
Debian Linux

How to mitigate CVE-2010-5108

Install update from vendor's website.

External References

http://www.openwall.com/lists/oss-security/2013/02/13/2
https://access.redhat.com/security/cve/cve-2010-5108
https://security-tracker.debian.org/tracker/CVE-2010-5108

Related Security Bulletins