1. Gentoo Linux Security Advisory
| Advisory Reference | GLSA 200612-14 / trac |
| Release Date | December 12, 2006 |
| Latest Revision | December 12, 2006: 01 |
| Impact | low |
| Exploitable | remote |
| Package | Vulnerable versions | Unaffected versions | Architecture(s) |
| www-apps/trac | < 0.10.1 | >= 0.10.1 | All supported architectures |
Related bugreports: #154574
Trac allows remote attackers to execute unauthorized actions as other users.
Trac is a wiki and issue tracking system for software development projects.
Trac allows users to perform certain tasks via HTTP requests without performing correct validation on those requests.
An attacker could entice an authenticated user to browse to a specially crafted URL, allowing the attacker to execute actions in the Trac instance as if they were the user.
There is no known workaround at this time.
All Trac users should upgrade to the latest version:
Code Listing 3.1: Resolution |
# emerge --sync # emerge --ask --oneshot --verbose ">=www-apps/trac-0.10.1" |