CVE-2009-2737
roundup - privilege escalation
EPSS 2.3%
描述
The EditCSVAction function in `cgi/actions.py` in Roundup 1.2 before 1.2.1, 1.4 through 1.4.6, and possibly other versions does not properly check permissions, which allows remote authenticated users with edit or create privileges for a class to modify arbitrary items within that class, as demonstrated by editing all queries, modifying settings, and adding roles to users.
如何修補 CVE-2009-2737
要修補 CVE-2009-2737,請將受影響套件升級到下列已修補版本。
- PyPI/roundup—升級至 1.2.1 或更新版本
- PyPI/roundup—升級至 1.2.1 或更新版本
CVE-2009-2737 正在被利用嗎?
低 — EPSS 為 2.3%,目前沒有觀察到大規模利用活動。
受影響套件(2)
- >= 1.2, < 1.2.1
- >= 1.2, < 1.2.1, >= 1.4, < 1.4.7