Multiple unspecified vulnerabilities in Roundup before 1.4.4 have unknown impact and attack vectors, some of which may be related to cross-site scripting (XSS).

The remote host is affected by the vulnerability described in GLSA-200805-21 (Roundup: Permission bypass)

    Philipp Gortan reported that the xml-rpc server in Roundup does not     check property permissions (CVE-2008-1475). Furthermore, Roland Meister     discovered multiple vulnerabilities caused by unspecified errors, some     of which may be related to cross-site scripting (CVE-2008-1474).
  Impact :

    A remote attacker could possibly exploit the first vulnerability to     edit or view restricted properties via the list(), display(), and set()     methods. The impact and attack vectors of the second vulnerability are     unknown.
  Workaround :

    There is no known workaround at this time.

Roundup, an issue tracking system, fails to properly escape HTML input, allowing an attacker to inject client-side code (typically JavaScript) into a document that may be viewed in the victim's browser.

- Fri Mar 7 2008 Paul P. Komkoff Jr <i at stingr.net> -     1.4.4-1

    - new upstream version with security fixes (bz#436546)

    - Wed Feb 20 2008 Paul P. Komkoff Jr <i at stingr.net> -       1.4.1-2

    - new upstream version

    - Wed Jan 23 2008 Paul P. Komkoff Jr <i at stingr.net> -       1.4.1-1

    - new upstream version

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

- Bug #436546 - Roundup 1.4.4 contains some sekrit     security fixes

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Severity
32450	GLSA-200805-21 : Roundup: Permission bypass	Nessus	Gentoo Local Security Checks	medium
32034	Debian DSA-1554-2 : roundup - insufficient input sanitising	Nessus	Debian Local Security Checks	medium
31435	Fedora 8 : roundup-1.4.4-1.fc8 (2008-2471)	Nessus	Fedora Local Security Checks	medium
31430	Fedora 7 : roundup-1.4.4-1.fc7 (2008-2370)	Nessus	Fedora Local Security Checks	medium

Detections

Analytics

CVE-2008-1474

critical

Tenable Plugins

medium

medium

medium

medium