{"containers": {"cna": {"affected": [{"product": "n/a", "vendor": "n/a", "versions": [{"status": "affected", "version": "n/a"}]}], "datePublic": "2014-07-21T00:00:00", "descriptions": [{"lang": "en", "value": "The Original File and Patched File resources in Review Board 1.7.x before 1.7.27 and 2.0.x before 2.0.4 allow remote authenticated users to bypass intended access restrictions and obtain sensitive information from repository files by leveraging knowledge of database ids."}], "problemTypes": [{"descriptions": [{"description": "n/a", "lang": "en", "type": "text"}]}], "providerMetadata": {"dateUpdated": "2018-03-29T17:57:01", "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "shortName": "mitre"}, "references": [{"tags": ["x_refsource_CONFIRM"], "url": "https://www.reviewboard.org/docs/releasenotes/reviewboard/2.0.4"}, {"name": "[oss-security] 20140722 Re: CVE requests for Review Board", "tags": ["mailing-list", "x_refsource_MLIST"], "url": "http://www.openwall.com/lists/oss-security/2014/07/22/12"}, {"tags": ["x_refsource_CONFIRM"], "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1123692"}, {"name": "reviewboard-cve20145028-sec-bypass(94813)", "tags": ["vdb-entry", "x_refsource_XF"], "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/94813"}, {"tags": ["x_refsource_CONFIRM"], "url": "https://www.reviewboard.org/news/2014/07/22/review-board-1-7-27-and-2-0-3-security-releases"}, {"tags": ["x_refsource_CONFIRM"], "url": "https://www.reviewboard.org/docs/releasenotes/reviewboard/1.7.27"}], "x_legacyV4Record": {"CVE_data_meta": {"ASSIGNER": "cve@mitre.org", "ID": "CVE-2014-5028", "STATE": "PUBLIC"}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"product_name": "n/a", "version": {"version_data": [{"version_value": "n/a"}]}}]}, "vendor_name": "n/a"}]}}, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": {"description_data": [{"lang": "eng", "value": "The Original File and Patched File resources in Review Board 1.7.x before 1.7.27 and 2.0.x before 2.0.4 allow remote authenticated users to bypass intended access restrictions and obtain sensitive information from repository files by leveraging knowledge of database ids."}]}, "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "n/a"}]}]}, "references": {"reference_data": [{"name": "https://www.reviewboard.org/docs/releasenotes/reviewboard/2.0.4", "refsource": "CONFIRM", "url": "https://www.reviewboard.org/docs/releasenotes/reviewboard/2.0.4"}, {"name": "[oss-security] 20140722 Re: CVE requests for Review Board", "refsource": "MLIST", "url": "http://www.openwall.com/lists/oss-security/2014/07/22/12"}, {"name": "https://bugzilla.redhat.com/show_bug.cgi?id=1123692", "refsource": "CONFIRM", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1123692"}, {"name": "reviewboard-cve20145028-sec-bypass(94813)", "refsource": "XF", "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/94813"}, {"name": "https://www.reviewboard.org/news/2014/07/22/review-board-1-7-27-and-2-0-3-security-releases", "refsource": "CONFIRM", "url": "https://www.reviewboard.org/news/2014/07/22/review-board-1-7-27-and-2-0-3-security-releases"}, {"name": "https://www.reviewboard.org/docs/releasenotes/reviewboard/1.7.27", "refsource": "CONFIRM", "url": "https://www.reviewboard.org/docs/releasenotes/reviewboard/1.7.27"}]}}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-06T11:34:37.305Z"}, "title": "CVE Program Container", "references": [{"tags": ["x_refsource_CONFIRM", "x_transferred"], "url": "https://www.reviewboard.org/docs/releasenotes/reviewboard/2.0.4"}, {"name": "[oss-security] 20140722 Re: CVE requests for Review Board", "tags": ["mailing-list", "x_refsource_MLIST", "x_transferred"], "url": "http://www.openwall.com/lists/oss-security/2014/07/22/12"}, {"tags": ["x_refsource_CONFIRM", "x_transferred"], "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1123692"}, {"name": "reviewboard-cve20145028-sec-bypass(94813)", "tags": ["vdb-entry", "x_refsource_XF", "x_transferred"], "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/94813"}, {"tags": ["x_refsource_CONFIRM", "x_transferred"], "url": "https://www.reviewboard.org/news/2014/07/22/review-board-1-7-27-and-2-0-3-security-releases"}, {"tags": ["x_refsource_CONFIRM", "x_transferred"], "url": "https://www.reviewboard.org/docs/releasenotes/reviewboard/1.7.27"}]}]}, "cveMetadata": {"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "assignerShortName": "mitre", "cveId": "CVE-2014-5028", "datePublished": "2018-03-29T18:00:00", "dateReserved": "2014-07-22T00:00:00", "dateUpdated": "2024-08-06T11:34:37.305Z", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.1"}

{}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:reviewboard:review_board:*:*:*:*:*:*:*:*", "matchCriteriaId": "C0E4A551-4486-45F0-A1D6-FC64106BC116", "versionEndExcluding": "1.7.27", "versionStartExcluding": "1.7.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:reviewboard:review_board:*:*:*:*:*:*:*:*", "matchCriteriaId": "08E0F82E-87B7-4FAF-9B7B-FDE8994DAD84", "versionEndExcluding": "2.0.4", "versionStartIncluding": "2.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "The Original File and Patched File resources in Review Board 1.7.x before 1.7.27 and 2.0.x before 2.0.4 allow remote authenticated users to bypass intended access restrictions and obtain sensitive information from repository files by leveraging knowledge of database ids."}, {"lang": "es", "value": "Los recursos Original File y Patched File en Review Board, en versiones 1.7.x anteriores a la 1.7.27 y versiones 2.0.x anteriores a la 2.0.4, permiten que usuarios autenticados remotos omitan las restricciones de acceso planeadas y obtengan informaci\u00f3n sensible de archivos de repositorios aprovechando el conocimiento de las ID de la base de datos."}], "id": "CVE-2014-5028", "lastModified": "2018-04-24T12:58:15.873", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "MEDIUM", "cvssData": {"accessComplexity": "LOW", "accessVector": "NETWORK", "authentication": "SINGLE", "availabilityImpact": "NONE", "baseScore": 4.0, "confidentialityImpact": "PARTIAL", "integrityImpact": "NONE", "vectorString": "AV:N/AC:L/Au:S/C:P/I:N/A:N", "version": "2.0"}, "exploitabilityScore": 8.0, "impactScore": 2.9, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": false}], "cvssMetricV30": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "version": "3.0"}, "exploitabilityScore": 2.8, "impactScore": 3.6, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2018-03-29T18:29:00.277", "references": [{"source": "cve@mitre.org", "tags": ["Mailing List", "Third Party Advisory"], "url": "http://www.openwall.com/lists/oss-security/2014/07/22/12"}, {"source": "cve@mitre.org", "tags": ["Issue Tracking", "Third Party Advisory"], "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1123692"}, {"source": "cve@mitre.org", "tags": ["Third Party Advisory", "VDB Entry"], "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/94813"}, {"source": "cve@mitre.org", "tags": ["Vendor Advisory"], "url": "https://www.reviewboard.org/docs/releasenotes/reviewboard/1.7.27"}, {"source": "cve@mitre.org", "tags": ["Vendor Advisory"], "url": "https://www.reviewboard.org/docs/releasenotes/reviewboard/2.0.4"}, {"source": "cve@mitre.org", "tags": ["Vendor Advisory"], "url": "https://www.reviewboard.org/news/2014/07/22/review-board-1-7-27-and-2-0-3-security-releases"}], "sourceIdentifier": "cve@mitre.org", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-200"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{}