CVE-2012-4533

ViewVC <1.0.13, <1.1.16 - XSS

Title source: llm

Description

Cross-site scripting (XSS) vulnerability in the "extra" details in the DiffSource._get_row function in lib/viewvc.py in ViewVC 1.0.x before 1.0.13 and 1.1.x before 1.1.16 allows remote authenticated users with repository commit access to inject arbitrary web script or HTML via the "function name" line.

References (16)

[Issue Tracking, Mailing List, Third Party Advisory] http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=691062

[Broken Link] http://osvdb.org/86566

[Third Party Advisory] http://secunia.com/advisories/51041

[Third Party Advisory] http://secunia.com/advisories/51072

[Third Party Advisory] http://viewvc.tigris.org/issues/show_bug.cgi?id=515

[Various Sources] http://viewvc.tigris.org/source/browse/%2Acheckout%2A/viewvc/tags/1.0.13/CHANGES

[Various Sources] http://viewvc.tigris.org/source/browse/%2Acheckout%2A/viewvc/tags/1.1.16/CHANGES

[Third Party Advisory] http://viewvc.tigris.org/source/browse/viewvc?view=rev&revision=2792

[Third Party Advisory] http://viewvc.tigris.org/source/browse/viewvc?view=rev&revision=2794

[Third Party Advisory] http://www.debian.org/security/2012/dsa-2563

[Third Party Advisory] http://www.mandriva.com/security/advisories?name=MDVSA-2013:134

[Mailing List, Third Party Advisory] http://www.openwall.com/lists/oss-security/2012/10/21/2

[Mailing List, Third Party Advisory] http://www.openwall.com/lists/oss-security/2012/10/21/3

[Third Party Advisory, VDB Entry] http://www.securityfocus.com/bid/56161

[Third Party Advisory, VDB Entry] https://exchange.xforce.ibmcloud.com/vulnerabilities/79561

[Third Party Advisory] https://wiki.mageia.org/en/Support/Advisories/MGASA-2012-0313

Scores

EPSS 0.0091

EPSS Percentile 75.6%

Details

CWE

CWE-79

Status published

Products (4)

viewvc/viewvc < 1.0.13

debian/debian_linux

debian/debian_linux

n/a/n/a

Published Nov 19, 2012

Tracked Since Feb 18, 2026