CVE-2009-5024
ViewVC < 1.1.11 - Resource Consumption via Limit Parameter Bypass
Title source: llmDescription
ViewVC before 1.1.11 allows remote attackers to bypass the cvsdb row_limit configuration setting, and consequently conduct resource-consumption attacks, via the limit parameter, as demonstrated by a "query revision history" request.
References (8)
Core 8
Core References
Issue Tracking x_refsource_confirm
http://viewvc.tigris.org/issues/show_bug.cgi?id=433
Third Party Advisory, VDB Entry vdb-entry
x_refsource_bid
http://www.securityfocus.com/bid/47928
Mailing List mailing-list
x_refsource_mlist
http://openwall.com/lists/oss-security/2011/05/19/9
Patch x_refsource_confirm
http://viewvc.tigris.org/source/browse/viewvc/trunk/lib/viewvc.py?diff_format=u&r1=2547&r2=2546&pathrev=2547
Mailing List mailing-list
x_refsource_mlist
http://openwall.com/lists/oss-security/2011/05/19/1
Third Party Advisory vendor-advisory
x_refsource_debian
http://www.debian.org/security/2012/dsa-2563
Various Sources x_refsource_confirm
http://viewvc.tigris.org/source/browse/%2Acheckout%2A/viewvc/tags/1.1.11/CHANGES
Various Sources x_refsource_confirm
http://viewvc.tigris.org/source/browse/viewvc/trunk/lib/cvsdb.py?diff_format=u&view=log#rev2547
Scores
EPSS
0.0264
EPSS Percentile
84.0%
Details
CWE
CWE-399
Status
published
Products (29)
viewvc/viewvc
0.8
viewvc/viewvc
0.9
viewvc/viewvc
0.9.1
viewvc/viewvc
0.9.2
viewvc/viewvc
0.9.3
viewvc/viewvc
0.9.4
viewvc/viewvc
1.0.0
viewvc/viewvc
1.0.1
viewvc/viewvc
1.0.2
viewvc/viewvc
1.0.3
... and 19 more
Published
May 23, 2011
Tracked Since
Feb 18, 2026