CVE-2009-2737

2009-08-1110:30:00

CWE-264

[email protected]

web.nvd.nist.gov

cve-2009-2737

roundup

cgi

actions.py

remote code execution

authenticated users

security vulnerability

5.5 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

SINGLE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:S/C:N/I:P/A:P

6.4 Medium

AI Score

Confidence

Low

0.002 Low

EPSS

Percentile

60.1%

JSON

The EditCSVAction function in cgi/actions.py in Roundup 1.2 before 1.2.1, 1.4 through 1.4.6, and possibly other versions does not properly check permissions, which allows remote authenticated users with edit or create privileges for a class to modify arbitrary items within that class, as demonstrated by editing all queries, modifying settings, and adding roles to users.

Affected configurations

NVD

Node

toni_muellerroundupMatch1.2.0

toni_muellerroundupMatch1.4.0

toni_muellerroundupMatch1.4.1

toni_muellerroundupMatch1.4.2

toni_muellerroundupMatch1.4.3

toni_muellerroundupMatch1.4.4

toni_muellerroundupMatch1.4.5

toni_muellerroundupMatch1.4.6

CPENameOperatorVersion
toni_mueller:rounduptoni mueller roundupeq1.2.0
toni_mueller:rounduptoni mueller roundupeq1.4.0
toni_mueller:rounduptoni mueller roundupeq1.4.1
toni_mueller:rounduptoni mueller roundupeq1.4.2
toni_mueller:rounduptoni mueller roundupeq1.4.3
toni_mueller:rounduptoni mueller roundupeq1.4.4
toni_mueller:rounduptoni mueller roundupeq1.4.5
toni_mueller:rounduptoni mueller roundupeq1.4.6

CPE	Name	Operator	Version
toni_mueller:roundup	toni mueller roundup	eq	1.2.0
toni_mueller:roundup	toni mueller roundup	eq	1.4.0
toni_mueller:roundup	toni mueller roundup	eq	1.4.1
toni_mueller:roundup	toni mueller roundup	eq	1.4.2
toni_mueller:roundup	toni mueller roundup	eq	1.4.3
toni_mueller:roundup	toni mueller roundup	eq	1.4.4
toni_mueller:roundup	toni mueller roundup	eq	1.4.5
toni_mueller:roundup	toni mueller roundup	eq	1.4.6