CVE-2014-5028

MediumCVSS 6.5/10Last modified Jun 17, 2026

Description

The Original File and Patched File resources in Review Board 1.7.x before 1.7.27 and 2.0.x before 2.0.4 allow remote authenticated users to bypass intended access restrictions and obtain sensitive information from repository files by leveraging knowledge of database ids.

Metrics

CVSS 3.0 6.5/10CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-200

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://www.openwall.com/lists/oss-security/2014/07/22/12Mailing List, Third Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=1123692Issue Tracking, Third Party Advisory
https://exchange.xforce.ibmcloud.com/vulnerabilities/94813Third Party Advisory, VDB Entry
https://www.reviewboard.org/docs/releasenotes/reviewboard/1.7.27Vendor Advisory
https://www.reviewboard.org/docs/releasenotes/reviewboard/2.0.4Vendor Advisory
https://www.reviewboard.org/news/2014/07/22/review-board-1-7-27-and-2-0-3-security-releasesVendor Advisory
http://www.openwall.com/lists/oss-security/2014/07/22/12Mailing List, Third Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=1123692Issue Tracking, Third Party Advisory
https://exchange.xforce.ibmcloud.com/vulnerabilities/94813Third Party Advisory, VDB Entry
https://www.reviewboard.org/docs/releasenotes/reviewboard/1.7.27Vendor Advisory
https://www.reviewboard.org/docs/releasenotes/reviewboard/2.0.4Vendor Advisory
https://www.reviewboard.org/news/2014/07/22/review-board-1-7-27-and-2-0-3-security-releasesVendor Advisory

Timeline

Published: Mar 29, 2018
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2014

CVE-2014-50291.5The web interface in CUPS 1.7.4 allows local users in the lp group to read arbitrary files via a symlink attack on a file in /var/cache/cups CVE-2014-50301.9CUPS before 2.0 allows local users to read arbitrary files via a symlink attack on (1) index.html, (2) index.class, (3) index.pl, (4) index.CVE-2014-50315.0The web interface in CUPS before 2.0 does not check that files have world-readable permissions, which allows remote attackers to obtains sen CVE-2014-50325.0GLPI before 0.84.7 does not properly restrict access to cost information, which allows remote attackers to obtain sensitive information via CVE-2014-50336.9KDE kdelibs before 4.14 and kauth before 5.1 does not properly use D-Bus for communication with a polkit authority, which allows local users CVE-2014-50348.8Cross-site request forgery (CSRF) vulnerability in the Brute Force Login Protection module 1.3 for WordPress allows remote attackers to hija CVE-2014-50356.8The Netconf (TCP) service in OpenDaylight 1.0 allows remote attackers to read arbitrary files via an XML external entity declaration in conj CVE-2014-50361.9The Storage Controller (SC) component in Eucalyptus 3.4.2 through 4.0.x before 4.0.1, when Dell Equallogic SAN is used, logs the CHAP user c CVE-2014-50372.1Eucalyptus 4.0.0 through 4.0.1, when the log level is set to INFO, logs user and system passwords, which allows local users to obtain sensit CVE-2014-50382.1Eucalyptus 3.0.0 through 4.0.1, when the log level is set to DEBUG or lower, logs user and system passwords, which allows local users to obt CVE-2014-50399.6Cross-site scripting (XSS) vulnerability in Eucalyptus Management Console (EMC) 4.0.x before 4.0.2 allows remote attackers to inject arbitra CVE-2014-50406.8HP Helion Eucalyptus 4.1.x before 4.1.2 and HPE Helion Eucalyptus 4.2.x before 4.2.1 allow remote authenticated users to bypass intended acc