CVE-2015-4082

MediumCVSS 6.5/10Last modified Jun 17, 2026

Description

attic before 0.15 does not confirm unencrypted backups with the user, which allows remote attackers with read and write privileges for the encrypted repository to obtain potentially sensitive information by changing the manifest type byte of the repository to "unencrypted / without key file".

Metrics

CVSS 3.0 6.5/10CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-264

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://www.openwall.com/lists/oss-security/2015/05/31/3Mailing List, Third Party Advisory
http://www.securityfocus.com/bid/74821Third Party Advisory, VDB Entry
https://github.com/jborg/attic/commit/78f9ad1faba7193ca7f0acccbc13b1ff6ebf9072Third Party Advisory
https://github.com/jborg/attic/issues/271Exploit, Third Party Advisory
http://www.openwall.com/lists/oss-security/2015/05/31/3Mailing List, Third Party Advisory
http://www.securityfocus.com/bid/74821Third Party Advisory, VDB Entry
https://github.com/jborg/attic/commit/78f9ad1faba7193ca7f0acccbc13b1ff6ebf9072Third Party Advisory
https://github.com/jborg/attic/issues/271Exploit, Third Party Advisory

Timeline

Published: Aug 18, 2017
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2015

CVE-2015-40844.3Cross-site scripting (XSS) vulnerability in the Free Counter plugin 1.1 for WordPress allows remote attackers to inject arbitrary web script CVE-2015-40857.5Directory traversal vulnerability in node/hooks/express/tests.js in Etherpad frontend tests before 1.6.1.CVE-2015-40898.8Multiple cross-site request forgery (CSRF) vulnerabilities in the optionsPageRequest function in admin.php in WP Fastest Cache plugin before CVE-2015-40917.5XML external entity (XXE) vulnerability in SAP NetWeaver AS Java 7.4 allows remote attackers to send TCP requests to intranet servers or pos CVE-2015-40927.5Buffer overflow in the XComms process in SAP Afaria 7.00.6620.2 SP5 allows remote attackers to cause a denial of service (crash) or possibly CVE-2015-40934.3Cross-site scripting (XSS) vulnerability in Elasticsearch Kibana 4.x before 4.0.3 allows remote attackers to inject arbitrary web script or CVE-2015-40945.8The Thycotic Password Manager Secret Server application through 2.3 for iOS does not verify X.509 certificates from SSL servers, which allow CVE-2015-41006.8Puppet Enterprise 3.7.x and 3.8.0 might allow remote authenticated users to manage certificates for arbitrary nodes by leveraging a client c CVE-2015-41034.9Xen 3.3.x through 4.5.x does not properly restrict write access to the host MSI message data field, which allows local x86 HVM guest adminis CVE-2015-41047.8Xen 3.3.x through 4.5.x does not properly restrict access to PCI MSI mask bits, which allows local x86 HVM guest users to cause a denial of CVE-2015-41054.9Xen 3.3.x through 4.5.x enables logging for PCI MSI-X pass-through error messages, which allows local x86 HVM guests to cause a denial of se CVE-2015-41064.6QEMU does not properly restrict write access to the PCI config space for certain PCI pass-through devices, which might allow local x86 HVM g