Lucene search

GitHub Advisory DatabaseGHSA-F9QV-J5G6-G5CR

HistoryMay 02, 2022 - 3:54 a.m.

Trac is vulnerable to improper policy checks and missing 'raw' role check in docutils

2022-05-0203:54:25

GitHub Advisory Database

github.com

trac

vulnerability

policy checks

missing 'raw' role

docutils

CVSS2

7.5

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:P/I:P/A:P

AI Score

Confidence

Low

EPSS

0.006

Percentile

78.2%

JSON

Multiple unspecified vulnerabilities in Trac before 0.11.6 have unknown impact and attack vectors, possibly related to (1) “policy checks in report results when using alternate formats” or (2) a “check for the ‘raw’ role that is missing in docutils < 0.6.”

Affected configurations

Vulners

Node

tractracRange<0.11.6

VendorProductVersionCPE
tractrac*cpe:2.3:a:trac:trac:*:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
trac	trac	*	cpe:2.3:a:trac:trac::::::::

References

trac.edgewall.org/browser/tags/trac-0.11.6/RELEASE

bugzilla.redhat.com/show_bug.cgi?id=542394

exchange.xforce.ibmcloud.com/vulnerabilities/54983

github.com/advisories/GHSA-f9qv-j5g6-g5cr

nvd.nist.gov/vuln/detail/CVE-2009-4405

web.archive.org/web/20130417170303/secunia.com/advisories/37901

web.archive.org/web/20130513235205/secunia.com/advisories/37807

www.redhat.com/archives/fedora-package-announce/2009-December/msg01169.html

CVSS2

7.5

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:P/I:P/A:P

AI Score

Confidence

Low

EPSS

0.006

Percentile

78.2%

JSON

Related for GHSA-F9QV-J5G6-G5CR