What’s Vulnerable › Vulnerabilities

CVE-2014-5028

• Severity: medium (CVSS 6.5 v3.0)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 1.6% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2018-03-29 · updated 2026-06-17
• Weakness: CWE-200

Description

The Original File and Patched File resources in Review Board 1.7.x before 1.7.27 and 2.0.x before 2.0.4 allow remote authenticated users to bypass intended access restrictions and obtain sensitive information from repository files by leveraging knowledge of database ids.

Affected products

• ReviewBoard Review Board: from 1.7.0 (excl.) before 1.7.27; from 2.0 before 2.0.4 — fixed in 1.7.27, 2.0.4

How to fix

Upgrade to a fixed version: ReviewBoard Review Board 1.7.27, 2.0.4. Check the vendor advisory for mitigations.

References

• http://www.openwall.com/lists/oss-security/2014/07/22/12
• https://bugzilla.redhat.com/show_bug.cgi?id=1123692
• https://exchange.xforce.ibmcloud.com/vulnerabilities/94813
• https://www.reviewboard.org/docs/releasenotes/reviewboard/1.7.27
• https://www.reviewboard.org/docs/releasenotes/reviewboard/2.0.4
• https://www.reviewboard.org/news/2014/07/22/review-board-1-7-27-and-2-0-3-security-releases
• http://www.openwall.com/lists/oss-security/2014/07/22/12
• https://bugzilla.redhat.com/show_bug.cgi?id=1123692
• https://exchange.xforce.ibmcloud.com/vulnerabilities/94813
• https://www.reviewboard.org/docs/releasenotes/reviewboard/1.7.27
• https://www.reviewboard.org/docs/releasenotes/reviewboard/2.0.4
• https://www.reviewboard.org/news/2014/07/22/review-board-1-7-27-and-2-0-3-security-releases

Get alerted when CVE-2014-5028 or the next vulnerability affects your stack