CVE-2010-0005: query.py in the query interface in ViewVC before 1.1.3 does not reject configurations that specify an unsup...

Security readout for executives and security teams

CVE-2010-0005 is an access-control bypass in ViewVC before 1.1.3. If a ViewVC root is configured with an unsupported authorizer, the query interface may fail to enforce intended restrictions, allowing remote users to see information they should not access. Exposure is most likely in older ViewVC deployments, especially installations before 1.1.3 that use repository-root authorizer configuration. The source bundle does not identify specific downstream package versions beyond vendor advisories. Treat this as a targeted legacy exposure issue. It can undermine source-code repository access controls, but the bundle provides no CVSS score or active exploitation evidence. Prioritize remediation where ViewVC is internet-facing or protects sensitive repositories. Mitigation focus: Upgrade ViewVC to version 1.1.3 or a vendor-fixed package.; Review Fedora, SUSE, or platform-specific advisories for packaged fixes.; Audit ViewVC roots for unsupported authorizer configuration..

Prepared

Jun 28, 2026, 03:36 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.