It was found that any user able to create or edit queries in roundup is able to edit all queries (delete or modify other user's queries). This is due to EditCSVAction not having the same level of control over queries that SearchAction does (both in cgi/actions.py). This gives users admin-level power over other user's queries. The upstream bug report is here: http://issues.roundup-tracker.org/issue2550521 and the Debian bug report is here: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=518768 The recommended fix from upstream is to disable EditCSVAction altogether.
Created roundup tracking bugs for this issue Affects: F10 [bug #489356] Affects: F9 [bug #489357]
Created attachment 334557 [details] patch from Debian's BTS to fix the issue This patch disables EditCSVAction.
roundup-1.4.6-4.fc10 has been pushed to the Fedora 10 stable repository. If problems still persist, please make note of it in this bug report.
roundup-1.4.6-4.fc9 has been pushed to the Fedora 9 stable repository. If problems still persist, please make note of it in this bug report.
CVE-2009-2737: The EditCSVAction function in cgi/actions.py in Roundup 1.2 before 1.2.1, 1.4 through 1.4.6, and possibly other versions does not properly check permissions, which allows remote authenticated users with edit or create privileges for a class to modify arbitrary items within that class, as demonstrated by editing all queries, modifying settings, and adding roles to users.