Homepage
About Snyk

Information Exposure Affecting roundup package, versions [,1.5.1)

Severity

 Recommended
0.0
medium
0
10

CVSS assessment made by Snyk's Security Team

    Threat Intelligence

    EPSS
    0.15% (53rd percentile)

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications
  • Snyk ID SNYK-PYTHON-ROUNDUP-40291
  • published 4 Mar 2016
  • disclosed 4 Mar 2016
  • credit Unknown
Report a new vulnerability Found a mistake?

Introduced: 4 Mar 2016

CVE-2014-6276 Open this link in a new tab
CWE-264 Open this link in a new tab

Overview

roundup is a simple-to-use and -install issue-tracking system with command-line, web and e-mail interfaces. Highly customisable. schema.py in Roundup before 1.5.1 does not properly limit attributes included in default user permissions, which might allow remote authenticated users to obtain sensitive user information by viewing user details.

CVSS Scores

version 3.1
Expand this section

Snyk

Recommended
4.3 medium
  • Attack Vector (AV)
    Network
  • Attack Complexity (AC)
    Low
  • Privileges Required (PR)
    Low
  • User Interaction (UI)
    None
  • Scope (S)
    Unchanged
  • Confidentiality (C)
    Low
  • Integrity (I)
    None
  • Availability (A)
    None