CVE-2012-4533 Cross-site scripting (XSS) vulnerability in the "extra" details in the DiffSource._get_row function in lib/viewvc.py in ViewVC 1.0.x before 1.0.13 and 1.1.x before 1.1.16 allows remote authenticated u...
MediumCVSS 4.3
EPSS 3.1%
- Published
- Updated
- Exploit status
- No public exploit known
Description
Cross-site scripting (XSS) vulnerability in the "extra" details in the DiffSource._get_row function in lib/viewvc.py in ViewVC 1.0.x before 1.0.13 and 1.1.x before 1.1.16 allows remote authenticated users with repository commit access to inject arbitrary web script or HTML via the "function name" line.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| viewvc | >= 1.0.0, < 1.0.13 | 1.0.13 |
| viewvc | >= 1.1.0, < 1.1.16 | 1.1.16 |
| debian linux | = 6.0 | No fix listed |
| debian linux | = 7.0 | No fix listed |
References
- bugs.debian.org issue-tracking mailing-list third-party-advisory
- 86566 broken-link vdb-entry
- 51041 third-party-advisory
- 51072 third-party-advisory
- viewvc.tigris.org third-party-advisory
- viewvc.tigris.org
- viewvc.tigris.org
- viewvc.tigris.org third-party-advisory
- viewvc.tigris.org third-party-advisory
- DSA-2563 third-party-advisory vendor-advisory
- MDVSA-2013:134 third-party-advisory vendor-advisory
- [oss-security] 20121020 CVE Request: viewvc 1.1.5 lib/viewvc.py XSS mailing-list third-party-advisory
- [oss-security] 20121020 Re: CVE Request: viewvc 1.1.5 lib/viewvc.py XSS mailing-list third-party-advisory
- 56161 third-party-advisory vdb-entry
- viewvc-viewvc-checkins-xss(79561) third-party-advisory vdb-entry
- wiki.mageia.org third-party-advisory