CVE-2000-0338

MEDIUM

Concurrent Versions Software - Improper Locking

Title source: rule

Description

Concurrent Versions Software (CVS) uses predictable temporary file names for locking, which allows local users to cause a denial of service by creating the lock directory before it is created for use by a legitimate CVS user.

Exploits (1)

exploitdb WORKING POC VERIFIED

by Michal Szymanski · perldoslinux

https://www.exploit-db.com/exploits/19870

View Code ZIP pw:eip

References (2)

[Broken Link, Exploit, Patch, Third Party Advisory, VDB Entry, Vendor Advisory] http://www.securityfocus.com/bid/1136

[Broken Link, Third Party Advisory, VDB Entry] http://www.securityfocus.com/frames/?content=/templates/archive.pike%3Flist%3D1%26msg%3D20000423174038.A520%40clico.pl

Scores

CVSS v3 5.5

EPSS 0.0125

EPSS Percentile 79.1%

Attack Vector LOCAL

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Classification

CWE

CWE-667

Status draft

Affected Products (1)

concurrent_versions_software_project/concurrent_versions_software

Timeline

Published Apr 23, 2000

Tracked Since Feb 18, 2026