CVE-2015-4082
MEDIUMAttic < 0.14 - Access Control
Title source: ruleDescription
attic before 0.15 does not confirm unencrypted backups with the user, which allows remote attackers with read and write privileges for the encrypted repository to obtain potentially sensitive information by changing the manifest type byte of the repository to "unencrypted / without key file".
Scores
CVSS v3
6.5
EPSS
0.0086
EPSS Percentile
74.8%
Attack Vector
NETWORK
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Details
CWE
CWE-264
Status
published
Products (3)
attic_project/attic
< 0.14
n/a/n/a
pypi/attic
< 0.15PyPI
Published
Aug 18, 2017
Tracked Since
Feb 18, 2026