What is GHSA-j556-q367-2gw6?

GHSA-j556-q367-2gw6 is a security advisory published by GitHub Security Advisories with Medium severity. Roundup sensitive data disclosure vulnerability

Which CVE IDs does GHSA-j556-q367-2gw6 cover?

GHSA-j556-q367-2gw6 covers the following CVE IDs: CVE-2014-6276. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-j556-q367-2gw6?

GHSA-j556-q367-2gw6 has a CVSS v3 base score of 4.3, published by GitHub Security Advisories.

Which products are affected by GHSA-j556-q367-2gw6?

GHSA-j556-q367-2gw6 affects 1 product, including: pip/roundup:\u003c 1.5.1.

GHSA-j556-q367-2gw6MediumCVSS 4.3

Roundup sensitive data disclosure vulnerability

Vendor

GitHub Security Advisories

Published

May 17, 2022

Last Modified

October 26, 2024

🔗 CVE IDs covered (1)

CVE-2014-6276 →

📋 Description

schema.py in Roundup before 1.5.1 does not properly limit attributes included in default user permissions, which might allow remote authenticated users to obtain sensitive user information by viewing user details.

🎯 Affected products1

pip/roundup:< 1.5.1

🔗 References (6)

https://nvd.nist.gov/vuln/detail/CVE-2014-6276
https://sourceforge.net/p/roundup/code/ci/tip/tree/CHANGES.txt
http://hg.code.sf.net/p/roundup/code/rev/a403c29ffaf9
http://www.debian.org/security/2016/dsa-3502
https://github.com/pypa/advisory-database/tree/main/vulns/roundup/PYSEC-2016-33.yaml
https://github.com/advisories/GHSA-j556-q367-2gw6