bugzilla.mozilla.orgConfirmation
http://bugzilla.mozilla.org/attachment.cgi?id=95950&action=view CVE-2003-0154
Mozilla Bonsai - Multiple Cross-Site Scripting Vulnerabilities
Record summary
CVE-2003-0154 has a selected CVSS score of 6.8; EIP currently links 1 catalogued exploit.
Description
Cross-site scripting vulnerabilities (XSS) in bonsai Mozilla CVS query tool allow remote attackers to execute arbitrary web script via (1) the file, root, or rev parameters to cvslog.cgi, (2) the file or root parameters to cvsblame.cgi, (3) various parameters to cvsquery.cgi, (4) the person parameter to showcheckins.cgi, (5) the module parameter to cvsqueryform.cgi, and (6) possibly other attack vectors as identified by Mozilla bug #146244.
Description source: CVE List
Exploitation context
Available material
- Catalogued exploits
- 1
Proofs of concept
1Catalogued exploits
ExploitDBMozilla Bonsai - Multiple Cross-Site Scripting VulnerabilitiesExploitDB exploitby Stan BubrouskiNot analyzed1 file
References
9bugzilla.mozilla.orgConfirmation
http://bugzilla.mozilla.org/attachment.cgi?id=95985&action=view bugzilla.mozilla.org
http://bugzilla.mozilla.org/show_bug.cgi?id=146244 bugzilla.mozilla.orgConfirmation
http://bugzilla.mozilla.org/show_bug.cgi?id=163573 20020819 Advisory: Bonsai XSS and Physical Path Revealing Vulnerabilitiesmailing list
http://marc.info/?l=bugtraq&m=102980129101054&w=2 DSA-265Vendor advisory
http://www.debian.org/security/2003/dsa-265 bonsai-error-message-xss(9920)vdb entry
http://www.iss.net/security_center/static/9920.php 5516vdb entry
http://www.securityfocus.com/bid/5516 nvd.nist.gov
https://nvd.nist.gov/vuln/detail/CVE-2003-0154