← Back to CVEs

CVE-2014-6275

MEDIUM

5.9

Description

FusionForge before 5.3.2 use scripts that run under the shared Apache user, which is also used by project homepages by default. If project webpages are hosted on the same server than FusionForge, it can allow users to incorrectly access on-disk private data in FusionForge.

CVE Details

CVSS v3.1 Score5.9

SeverityMEDIUM

CVSS VectorCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

Attack VectorNETWORK

ComplexityHIGH

Privileges RequiredNONE

User InteractionNONE

Published1/2/2020

Last Modified11/21/2024

Sourcenvd

Honeypot Sightings0

Affected Products

debian:debian_linuxfusionforge:fusionforge

Weaknesses (CWE)

CWE-200

References

http://lists.fusionforge.org/pipermail/fusionforge-general/2014-September/002824.html(security@debian.org)

https://security-tracker.debian.org/tracker/CVE-2014-6275(security@debian.org)

http://lists.fusionforge.org/pipermail/fusionforge-general/2014-September/002824.html(af854a3a-2127-422b-91ae-364da2661108)

https://security-tracker.debian.org/tracker/CVE-2014-6275(af854a3a-2127-422b-91ae-364da2661108)

IOC Correlations

No correlations recorded

This product uses data from the NVD API but is not endorsed or certified by the NVD.