CVE-2010-5108

HighCVSS 7.5/10Last modified Jun 16, 2026

Description

Trac 0.11.6 does not properly check workflow permissions before modifying a ticket. This can be exploited by an attacker to change the status and resolution of tickets without having proper permissions.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Weakness enumeration

CWE-276

Affected software

Vendor	Product	Versions
trac	trac	0.11.6

References

http://www.openwall.com/lists/oss-security/2013/02/13/2Mailing List, Third Party Advisory
https://access.redhat.com/security/cve/cve-2010-5108Broken Link, Third Party Advisory
https://security-tracker.debian.org/tracker/CVE-2010-5108Third Party Advisory
http://www.openwall.com/lists/oss-security/2013/02/13/2Mailing List, Third Party Advisory
https://access.redhat.com/security/cve/cve-2010-5108Broken Link, Third Party Advisory
https://security-tracker.debian.org/tracker/CVE-2010-5108Third Party Advisory

Timeline

Published: Nov 13, 2019
Last modified: Jun 16, 2026
NVD status: Modified

Related CVEs from 2010

CVE-2010-51094.3Off-by-one error in the DecompressRTF function in ytnef.c in Yerase's TNEF Stream Reader allows remote attackers to cause a denial of servic CVE-2010-51104.3DCTStream.cc in Poppler before 0.13.3 allows remote attackers to cause a denial of service (crash) via a crafted PDF file.CVE-2010-51116.8Multiple buffer overflows in readline.c in Echoping 6.0.2 allow remote attackers to cause a denial of service (crash) and possibly execute a CVE-2010-51375.0wxBitcoin and bitcoind before 0.3.5 allow remote attackers to cause a denial of service (daemon crash) via a Bitcoin transaction containing CVE-2010-51385.0wxBitcoin and bitcoind 0.3.x allow remote attackers to cause a denial of service (electricity consumption) via a Bitcoin transaction contain CVE-2010-51397.5Integer overflow in wxBitcoin and bitcoind before 0.3.11 allows remote attackers to bypass intended economic restrictions and create many bi CVE-2010-51405.0wxBitcoin and bitcoind before 0.3.13 do not properly handle bitcoins associated with Bitcoin transactions that have zero confirmations, whic CVE-2010-51417.5wxBitcoin and bitcoind before 0.3.5 do not properly handle script opcodes in Bitcoin transactions, which allows remote attackers to spend bi CVE-2010-51426.5chef-server-api/app/controllers/users.rb in the API in Chef before 0.9.0 does not require administrative privileges for the create, destroy,CVE-2010-51432.6McAfee VirusScan Enterprise before 8.8 allows local users to disable the product by leveraging administrative privileges to execute an unspe CVE-2010-51444.3The ISAPI Filter plug-in in Websense Enterprise, Websense Web Security, and Websense Web Filter 6.3.3 and earlier, when used in conjunction CVE-2010-51454.3The Filtering Service in Websense Web Security and Web Filter before 6.3.1 Hotfix 136 and 7.x before 7.1.1 on Windows allows remote attacker