CVE-2014-5028

The Original File and Patched File resources in Review Board 1.7.x before 1.7.27 and 2.0.x before 2.0.4 allow remote authenticated users to bypass intended access restrictions and obtain sensitive information from repository files by leveraging knowledge of database ids.

Score

CVSS 3.0 6.5 Medium

Status

Modified - cve@mitre.org

Published

2018-03-29

Last modified

2024-08-06

Weaknesses

CWE-200

Affected products

• Review Board (Reviewboard)

References

• http://www.openwall.com/lists/oss-security/2014/07/22/12
• https://bugzilla.redhat.com/show_bug.cgi?id=1123692
• https://exchange.xforce.ibmcloud.com/vulnerabilities/94813
• https://www.reviewboard.org/docs/releasenotes/reviewboard/1.7.27
• https://www.reviewboard.org/docs/releasenotes/reviewboard/2.0.4
• https://www.reviewboard.org/news/2014/07/22/review-board-1-7-27-and-2-0-3-security-releases