CWE-527: Exposure of CVS Repository to an Unauthorized Control Sphere
Exposure of CVS Repository to an Unauthorized Control Sphere
Weakness ID: 527 (Weakness Variant)
Status: Incomplete
Description
Description Summary
The product stores a CVS repository in a directory or other container that is accessible to actors outside of the intended control sphere.
Extended Description
Information contained within a CVS subdirectory on a web server or other server could be recovered by an attacker and used for malicious purposes. This information may include usernames, filenames, path root, and IP addresses.
Time of Introduction
Operation
Common Consequences
Scope
Effect
Confidentiality
Technical Impact: Read application
data; Read files or
directories
Potential Mitigations
Recommendations include removing any CVS directories and repositories
from the production server, disabling the use of remote CVS
repositories, and ensuring that the latest CVS patches and version
updates have been performed.
Description
