Vulnerability Description
The Original File and Patched File resources in Review Board 1.7.x before 1.7.27 and 2.0.x before 2.0.4 allow remote authenticated users to bypass intended access restrictions and obtain sensitive information from repository files by leveraging knowledge of database ids.
CVSS Score
MEDIUM
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Reviewboard | Review Board | < 1.7.27 |
Related Weaknesses (CWE)
References
- http://www.openwall.com/lists/oss-security/2014/07/22/12Mailing ListThird Party Advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=1123692Issue TrackingThird Party Advisory
- https://exchange.xforce.ibmcloud.com/vulnerabilities/94813Third Party AdvisoryVDB Entry
- https://www.reviewboard.org/docs/releasenotes/reviewboard/1.7.27Vendor Advisory
- https://www.reviewboard.org/docs/releasenotes/reviewboard/2.0.4Vendor Advisory
- https://www.reviewboard.org/news/2014/07/22/review-board-1-7-27-and-2-0-3-securiVendor Advisory
- http://www.openwall.com/lists/oss-security/2014/07/22/12Mailing ListThird Party Advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=1123692Issue TrackingThird Party Advisory
- https://exchange.xforce.ibmcloud.com/vulnerabilities/94813Third Party AdvisoryVDB Entry
- https://www.reviewboard.org/docs/releasenotes/reviewboard/1.7.27Vendor Advisory
- https://www.reviewboard.org/docs/releasenotes/reviewboard/2.0.4Vendor Advisory
- https://www.reviewboard.org/news/2014/07/22/review-board-1-7-27-and-2-0-3-securiVendor Advisory
FAQ
What is CVE-2014-5028?
CVE-2014-5028 is a vulnerability with a CVSS score of 6.5 (MEDIUM). The Original File and Patched File resources in Review Board 1.7.x before 1.7.27 and 2.0.x before 2.0.4 allow remote authenticated users to bypass intended access restrictions and obtain sensitive inf...
How severe is CVE-2014-5028?
CVE-2014-5028 has been rated MEDIUM with a CVSS base score of 6.5/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2014-5028?
Check the references section above for vendor advisories and patch information. Affected products include: Reviewboard Review Board.