The EditCSVAction function in cgi/actions.py in Roundup 1.2 before 1.2.1, 1.4 through 1.4.6, and possibly other versions does not properly check permissions, which allows remote authenticated users with edit or create pr…
CVSS 2.0MEDIUM 5.5·Network·Low privileges·Interaction —·EPSS 0.02341·Published 2009-08-11·Fixed in 1.2.1, 1.4.7CWE-264