CVE-2008-1475
Roundup xml-rpc server improper check of property permissions
CVE-2008-1475 is a medium vulnerability (CVSS 6.4) in Roundup-tracker Roundup, published March 24, 2008. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.76%, the 77th percentile. Fixed in roundup 1.4.5.
The xml-rpc server in Roundup 1.4.4 does not check property permissions, which allows attackers to bypass restrictions and edit or read restricted properties via the (1) list, (2) display, and (3) set methods.
Exploit likelihood
What each source reports
NVD Score used
The xml-rpc server in Roundup 1.4.4 does not check property permissions, which allows attackers to bypass restrictions and edit or read restricted properties via the (1) list, (2) display, and (3) set methods.
- Record
CVE-2008-1475- CVSS 2.0
- 6.4 Medium
AV:N/AC:L/Au:N/C:P/I:P/A:N - Weakness
- CWE-264
- Updated
- 2026-11-02
CVE List No score
The xml-rpc server in Roundup 1.4.4 does not check property permissions, which allows attackers to bypass restrictions and edit or read restricted properties via the (1) list, (2) display, and (3) set methods.
- Record
CVE-2008-1475- Updated
- 2026-11-02
EUVDEUVD-2008-0009 No score
The xml-rpc server in Roundup 1.4.4 does not check property permissions, which allows attackers to bypass restrictions and edit or read restricted properties via the (1) list, (2) display, and (3) set methods.
- Record
EUVD-2008-0009- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-j59j-h3g7-cpmf
Roundup xml-rpc server improper check of property permissions
The xml-rpc server in Roundup 1.4.4 does not check property permissions, which allows attackers to bypass restrictions and edit or read restricted properties via the (1) list, (2) display, and (3) set methods.
- Record
GHSA-j59j-h3g7-cpmf- CVSS 4.0
- 9.3 Critical
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N - CVSS 3.1
- 9.1 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N - Weakness
- CWE-284
- Updated
- 2026-11-02
OSVGHSA-j59j-h3g7-cpmf
Roundup xml-rpc server improper check of property permissions
The xml-rpc server in Roundup 1.4.4 does not check property permissions, which allows attackers to bypass restrictions and edit or read restricted properties via the (1) list, (2) display, and (3) set methods.
- Record
GHSA-j59j-h3g7-cpmf- CVSS 4.0
- 9.3 Critical
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N - CVSS 3.1
- 9.1 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N - Weakness
- CWE-284
- Updated
- 2026-11-02
OSVPYSEC-2008-10 No score
The xml-rpc server in Roundup 1.4.4 does not check property permissions, which allows attackers to bypass restrictions and edit or read restricted properties via the (1) list, (2) display, and (3) set methods.
- Record
PYSEC-2008-10- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
roundupPyPI |
before 1.4.5 | 1.4.5 |
roundupPyPI |
before 1.4.5, plus listed versions 0.5.90.6.110.6.80.6.90.7.0 Show 36 moreShow less0.7.0b30.7.10.7.110.7.120.7.20.7.30.7.40.7.50.7.70.7.80.7.90.8.00.8.0b10.8.10.8.20.8.30.8.40.8.50.8.60.9.0b11.01.0.11.1.01.1.11.1.21.2.01.2.11.3.01.3.11.3.21.3.31.4.01.4.11.4.21.4.31.4.4 |
1.4.5 |
History
| When | Changed | Sources |
|---|---|---|
| 2026-11-03 | aliases | EUVD |
| 2026-11-02 | created | CVE List, GitHub Advisories, NVD, OSV |
References
secunia.com/advisories/30274
redhat.com/archives/fedora-package-announce/2008-November/msg00478.html
securityfocus.com/bid/28238
security.gentoo.org/glsa/glsa-200805-21.xml
sourceforge.net/tracker/index.php?func=detail&aid=1907211&group_id=31577&atid=402788
Show 13 moreShow less
bugzilla.redhat.com/show_bug.cgi?id=436546
exchange.xforce.ibmcloud.com/vulnerabilities/41240
vupen.com/english/advisories/2008/0891
nvd.nist.gov/vuln/detail/CVE-2008-1475
github.com/roundup-tracker/roundup/commit/c00b7e5801f8baa246fa76b4aad5287882310189