CVE-2010-0004: ViewVC before 1.1.3 composes the root listing view without using the authorizer for each root, which might...

Security readout for executives and security teams

ViewVC could expose the names of private repository roots on its root listing page. The sources describe disclosure of names only, not repository contents or code execution. The business risk is sensitive project or repository discovery that could support follow-on targeting. Exposure is likely limited to organizations running ViewVC before 1.1.3 with private roots configured and a remotely reachable root listing view. The provided affected-product metadata is incomplete, so inventory should confirm actual ViewVC versions and distribution packages. Handle during normal patch management unless ViewVC exposes sensitive repository names to untrusted users. Prioritize faster if repository names reveal confidential customers, acquisitions, security projects, or regulated workloads. Mitigation focus: Upgrade ViewVC to 1.1.3 or a vendor package containing the fix.; Apply Fedora, SUSE, or other distribution security updates where ViewVC is packaged.; Restrict access to ViewVC root listing pages until patched..

Prepared

Jun 28, 2026, 03:36 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.