CVE-2002-0771 Cross-site scripting vulnerability in viewcvs.cgi for ViewCVS 0.9.2 allows remote attackers to inject script and steal cookies via the (1) cvsroot or (2) sortby parameters.
MediumCVSS 6.4
EPSS 7.2%
- Published
- Updated
- Exploit status
- No public exploit known
Description
Cross-site scripting vulnerability in viewcvs.cgi for ViewCVS 0.9.2 allows remote attackers to inject script and steal cookies via the (1) cvsroot or (2) sortby parameters.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| viewcvs | = 0.8 | No fix listed |
| viewcvs | = 0.9 | No fix listed |
| viewcvs | = 0.9.1 | No fix listed |
| viewcvs | = 0.9.2 | No fix listed |
References
- 20020518 cross-site scripting bug of ViewCVS mailing-list patch vendor-advisory
- viewcvs-css(9112) patch vdb-entry vendor-advisory
- 4818 exploit patch vdb-entry vendor-advisory