CVE-2009-2737
roundup - privilege escalation
EPSS 1.1%
Description
The EditCSVAction function in `cgi/actions.py` in Roundup 1.2 before 1.2.1, 1.4 through 1.4.6, and possibly other versions does not properly check permissions, which allows remote authenticated users with edit or create privileges for a class to modify arbitrary items within that class, as demonstrated by editing all queries, modifying settings, and adding roles to users.
How to fix CVE-2009-2737
To remediate CVE-2009-2737, upgrade the affected package to a fixed version below.
- Debian/roundup—upgrade to 1.2.1-10+etch1 or later
- PyPI/roundup—upgrade to 1.2.1 or later
Is CVE-2009-2737 being exploited?
Low — EPSS is 1.1%, meaning exploitation activity has not been observed at scale.
Affected packages (2)
- from 0, < 1.2.1-10+etch1
- >= 1.2, < 1.2.1