CVE-2014-6275

MediumCVSS 5.9/10Last modified Jun 17, 2026

Description

FusionForge before 5.3.2 use scripts that run under the shared Apache user, which is also used by project homepages by default. If project webpages are hosted on the same server than FusionForge, it can allow users to incorrectly access on-disk private data in FusionForge.

Metrics

CVSS 3.1 5.9/10CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-200

Affected software

No affected versions have been published.

Timeline

Published: Jan 2, 2020
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2014

CVE-2014-62764.3schema.py in Roundup before 1.5.1 does not properly limit attributes included in default user permissions, which might allow remote authenti CVE-2014-627710.0GNU Bash through 4.3 bash43-026 does not properly parse function definitions in the values of environment variables, which allows remote att CVE-2014-62788.8GNU Bash through 4.3 bash43-026 does not properly parse function definitions in the values of environment variables, which allows remote att CVE-2014-62804.3Multiple cross-site scripting (XSS) vulnerabilities in OSClass before 3.4.2 allow remote attackers to inject arbitrary web script or HTML vi CVE-2014-62836.5SAP Adaptive Server Enterprise (ASE) 15.7 before SP122 or SP63, 15.5 before ESD#5.4, and 15.0.3 before ESD#4.4 does not properly restrict ac CVE-2014-62847.5SAP Adaptive Server Enterprise (ASE) before 15.7 SP132 and 16.0 before 16.0 SP01 allows remote attackers to bypass the challenge and respons CVE-2014-62879.8The findMacroMarker function in parserLib.pas in Rejetto HTTP File Server (aks HFS or HttpFileServer) 2.3x before 2.3c allows remote attacke CVE-2014-62887.5The powermail extension 2.x before 2.0.11 for TYPO3 allows remote attackers to bypass the CAPTCHA protection mechanism via unspecified vecto CVE-2014-62897.5The Ajax dispatcher for Extbase in the Yet Another Gallery (yag) extension before 3.0.1 and Tools for Extbase development (pt_extbase) exten CVE-2014-62907.5The News (tt_news) extension before 3.5.2 for TYPO3 allows remote attackers to have unspecified impact via vectors related to an "insecure u CVE-2014-62914.3Cross-site scripting (XSS) vulnerability in the Alphabetic Sitemap (alpha_sitemap) extension 0.0.3 and earlier for TYPO3 allows remote attac CVE-2014-62926.4The femanager extension before 1.0.9 for TYPO3 allows remote frontend users to modify or delete the records of other frontend users via unsp