Date: Tue, 20 Jan 2015 16:45:55 +0100 From: Salvatore Bonaccorso <carnil@...ian.org> To: OSS Security Mailinglist <oss-security@...ts.openwall.com> Cc: CVE Assignments MITRE <cve-assign@...re.org> Subject: Possible CVE request: sympa: vulnerability in the web interface Hi I would like to ask if a CVE could be assigned for the following issue (it is not clear if upstream has already requested one): https://www.sympa.org/security_advisories#security_breaches_in_newsletter_posting The advisory reads: > A vulnerability have been discovered in Sympa web interface that > allows access to files on the server filesystem. > > This breach allows to send to a list or a user any file readable by > the Sympa user, located on the server filesystem, using the Sympa web > interface newsletter posting area. Upstream patch: https://sourcesup.renater.fr/scm/viewvc.php/branches/sympa-6.1-branch/wwsympa/wwsympa.fcgi.in?root=sympa&r1=11562&r2=11778&view=patch Thanks in advance, Regards, Salvatore
Powered by blists - more mailing lists
Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.
Powered by Openwall GNU/*/Linux - Powered by OpenVZ