CVE-2008-1290: viewvc

EPSS trend

Probability

1.37%

Chance of exploitation in the next 30 days

Percentile

72%

Versus all other CVEs

30-day change

0.00 pp

From 1.37% on 21-09-2026

21-09-202621-10-2026

EPSS score

1.37%

Known exploited

Compare KEV catalogs

Not in any of the 3 tracked catalogs.

Public exploits

0 found

No public exploits indexed.

References

8 links

security.gentoo.org/glsa/glsa-200803-29.xmlVendor AdvisoryX Refsource GENTOO
secunia.com/advisories/29460Third Party AdvisoryX Refsource SECUNIAVendor Advisory
secunia.com/advisories/29176Third Party AdvisoryX Refsource SECUNIAVendor Advisory
bugs.debian.org/cgi-bin/bugreport.cgi?bug=471380X Refsource CONFIRM
www.vupen.com/english/advisories/2008/0734/referencesVDB EntryX Refsource VUPEN
www.securityfocus.com/bid/28055VDB EntryX Refsource BIDPatch
bugs.gentoo.org/show_bug.cgi?id=212288X Refsource CONFIRM
viewvc.tigris.org/source/browse/viewvc/trunk/CHANGES?rev=HEADX Refsource CONFIRM

Related vulnerabilities

CVE-2007-5743debiandebian_linux+11.10%6y ago07-11-2019 21:55viewvc 1.0.3 allows improper access control to files in a repository when using the "forbidden" configuration option.CVE-2025-54141ubuntuviewvc+20.85%1y ago22-07-2025 21:35ViewVC is a browser interface for CVS and Subversion version control repositories. In versions 1.1.0 through 1.1.31 and 1.2.0 through 1.2.3, the standalone.py script provided in the ViewVC distribution can expose the contents of the host server's filesystem though a directory traversal-style attack. This is fixed in versions 1.1.31 and 1.2.4.CVE-2020-5283ubuntuviewvc+61.36%6y ago03-04-2020 00:10ViewVC before versions 1.1.28 and 1.2.1 has a XSS vulnerability in CVS show_subdir_lastmod support. The impact of this vulnerability is mitigated by the need for an attacker to have commit privileges to a CVS repository exposed by an otherwise trusted ViewVC instance that also has the `show_subdir_lastmod` feature enabled. The attack vector involves files with unsafe names (names that, when embedded into an HTML stream, would cause the browser to run unwanted code), which themselves can be challenging to create. This vulnerability is patched in versions 1.2.1 and 1.1.28.CVE-2008-1292viewvcviewvc1.37%18y ago24-03-2008 17:00ViewVC before 1.0.5 provides revision metadata without properly checking whether access was intended, which allows remote attackers to obtain sensitive information by reading (1) forbidden pathnames in the revision view, (2) log history that can only be reached by traversing a forbidden object, or (3) forbidden diff view path parameters.CVE-2008-1291viewvcviewvc1.37%18y ago24-03-2008 17:00ViewVC before 1.0.5 stores sensitive information under the web root with insufficient access control, which allows remote attackers to read files and list folders under the hidden CVSROOT folder.CVE-2008-4325debianviewvc+11.45%18y ago30-09-2008 16:00lib/viewvc.py in ViewVC 1.0.5 uses the content-type parameter in the HTTP request for the Content-Type header in the HTTP response, which allows remote attackers to cause content to be misinterpreted by the browser via a content-type parameter that is inconsistent with the requested object. NOTE: this issue might not be a vulnerability, since it requires attacker access to the repository that is being viewed.

All vulnerabilities inviewvc

CVE-2008-1290: viewvc

Vulnerability summary

Timeline

Description

CVSS metrics

EPSS trend

Known exploited

Public exploits

Weaknesses

Affected systems

References