CVE-2008-1291: viewvc

EPSS trend

Probability

1.37%

Chance of exploitation in the next 30 days

Percentile

72%

Versus all other CVEs

30-day change

No change 0.00 pp

From 1.37% on 22-09-2026

22-09-202622-10-2026

Known exploited

Compare KEV catalogs

CISA KEV

Not in the CISA KEV catalog.

ENISA CNW

Not in the ENISA CNW catalog.

CIRCL

Not in the CIRCL catalog.

Public exploits

0 found

No public exploits indexed.

References

8 links

security.gentoo.org/glsa/glsa-200803-29.xmlVendor AdvisoryX Refsource GENTOO
secunia.com/advisories/29460Third Party AdvisoryX Refsource SECUNIAVendor Advisory
secunia.com/advisories/29176Third Party AdvisoryX Refsource SECUNIAVendor Advisory
bugs.debian.org/cgi-bin/bugreport.cgi?bug=471380X Refsource CONFIRM
www.vupen.com/english/advisories/2008/0734/referencesVDB EntryX Refsource VUPEN
www.securityfocus.com/bid/28055VDB EntryX Refsource BIDPatch
bugs.gentoo.org/show_bug.cgi?id=212288X Refsource CONFIRM
viewvc.tigris.org/source/browse/viewvc/trunk/CHANGES?rev=HEADX Refsource CONFIRM

Related vulnerabilities

HighCVE-2007-5743debian · debian_linux +1 more6y agodebian debian_linuxviewvc 1.0.3 allows improper access control to files in a repository when using the "forbidden" configuration option.EPSS1.10%HighCVE-2025-54141ubuntu · viewvc +2 more1y agoViewVC's standalone server exposes arbitrary server filesystem contentViewVC is a browser interface for CVS and Subversion version control repositories. In versions 1.1.0 through 1.1.31 and 1.2.0 through 1.2.3, the standalone.py script provided in the ViewVC distribution can expose the contents of the host server's filesystem though a directory traversal-style attack. This is fixed in versions 1.1.31 and 1.2.4.EPSS0.85%LowCVE-2020-5283ubuntu · viewvc +6 more6y agoXSS vulnerability in CVS show_subdir_lastmod supportViewVC before versions 1.1.28 and 1.2.1 has a XSS vulnerability in CVS show_subdir_lastmod support. The impact of this vulnerability is mitigated by the need for an attacker to have commit privileges to a CVS repository exposed by an otherwise trusted ViewVC instance that also has the `show_subdir_lastmod` feature enabled. The attack vector involves files with unsafe names (names that, when embedded into an HTML stream, would cause the browser to run unwanted code), which themselves can be challenging to create. This vulnerability is patched in versions 1.2.1 and 1.1.28.EPSS1.36%MediumCVE-2008-1292viewvc18y agoviewvc viewvcViewVC before 1.0.5 provides revision metadata without properly checking whether access was intended, which allows remote attackers to obtain sensitive information by reading (1) forbidden pathnames in the revision view, (2) log history that can only be reached by traversing a forbidden object, or (3) forbidden diff view path parameters.EPSS1.37%MediumCVE-2008-1290viewvc18y agoviewvc viewvcViewVC before 1.0.5 includes "all-forbidden" files within search results that list CVS or Subversion (SVN) commits, which allows remote attackers to obtain sensitive information.EPSS1.37%MediumCVE-2008-4325debian · viewvc +1 more18y agodebian viewvclib/viewvc.py in ViewVC 1.0.5 uses the content-type parameter in the HTTP request for the Content-Type header in the HTTP response, which allows remote attackers to cause content to be misinterpreted by the browser via a content-type parameter that is inconsistent with the requested object. NOTE: this issue might not be a vulnerability, since it requires attacker access to the repository that is being viewed.EPSS1.45%

All vulnerabilities inviewvc

CVE-2008-1291: viewvc

Vulnerability summary

Timeline

Description

CVSS metrics

EPSS trend

Known exploited

Public exploits

Weaknesses

Affected systems

References