Description
Cross-site scripting vulnerabilities (XSS) in bonsai Mozilla CVS query tool allow remote attackers to execute arbitrary web script via (1) the file, root, or rev parameters to cvslog.cgi, (2) the file or root parameters to cvsblame.cgi, (3) various parameters to cvsquery.cgi, (4) the person parameter to showcheckins.cgi, (5) the module parameter to cvsqueryform.cgi, and (6) possibly other attack vectors as identified by Mozilla bug #146244.
Exploits (1)
exploitdb
WORKING POC
VERIFIED
by Stan Bubrouski · textwebappscgi
https://www.exploit-db.com/exploits/21729
References (8)
Core 8
Core References
Issue Tracking x_refsource_confirm
http://bugzilla.mozilla.org/attachment.cgi?id=95985&action=view
Issue Tracking x_refsource_confirm
http://bugzilla.mozilla.org/attachment.cgi?id=95950&action=view
Exploit, Patch, Vendor Advisory vdb-entry
x_refsource_bid
http://www.securityfocus.com/bid/5516
Third Party Advisory vdb-entry
x_refsource_xf
http://www.iss.net/security_center/static/9920.php
Mailing List mailing-list
x_refsource_bugtraq
http://marc.info/?l=bugtraq&m=102980129101054&w=2
Issue Tracking x_refsource_confirm
http://bugzilla.mozilla.org/show_bug.cgi?id=163573
Patch, Vendor Advisory vendor-advisory
x_refsource_debian
http://www.debian.org/security/2003/dsa-265
Issue Tracking x_refsource_misc
http://bugzilla.mozilla.org/show_bug.cgi?id=146244
Scores
EPSS
0.1333
EPSS Percentile
94.2%
Details
Status
published
Products (1)
mozilla/bonsai
1.3
Published
Apr 02, 2003
Tracked Since
Feb 18, 2026