CVE-2008-1475

Severity: medium (CVSS 6.4 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.8% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2008-03-24 · updated 2026-06-16
Weakness: CWE-264

Description

The xml-rpc server in Roundup 1.4.4 does not check property permissions, which allows attackers to bypass restrictions and edit or read restricted properties via the (1) list, (2) display, and (3) set methods.

Affected products

roundup-tracker Roundup: through 1.4.3; 0.1.0, 0.1.1, 0.1.2, 0.1.3, 0.2.0, 0.2.1 (+87)

References

http://secunia.com/advisories/29336
http://secunia.com/advisories/29375
http://secunia.com/advisories/30274
http://secunia.com/advisories/32805
http://security.gentoo.org/glsa/glsa-200805-21.xml
http://sourceforge.net/tracker/index.php?func=detail&aid=1907211&group_id=31577&atid=402788
http://www.securityfocus.com/bid/28238
http://www.vupen.com/english/advisories/2008/0891
https://bugzilla.redhat.com/show_bug.cgi?id=436546
https://exchange.xforce.ibmcloud.com/vulnerabilities/41240
https://www.redhat.com/archives/fedora-package-announce/2008-March/msg00264.html
https://www.redhat.com/archives/fedora-package-announce/2008-March/msg00375.html

Get alerted when CVE-2008-1475 or the next vulnerability affects your stack