CVE-2014-3994

Djblets < 0.7.30 and 0.8.x < 0.8.3 - Cross-Site Scripting via JSON Object in User Name Field

Title source: llm
STIX 2.1

Description

Cross-site scripting (XSS) vulnerability in util/templatetags/djblets_js.py in Djblets before 0.7.30 and 0.8.x before 0.8.3 for Django, as used in Review Board, allows remote attackers to inject arbitrary web script or HTML via a JSON object, as demonstrated by the name field when changing a user name.

References (8)

Core 8
Core References
Third Party Advisory, VDB Entry mailing-list x_refsource_mlist
http://seclists.org/oss-sec/2014/q2/494
Third Party Advisory, VDB Entry mailing-list x_refsource_mlist
http://seclists.org/oss-sec/2014/q2/498
Third Party Advisory, VDB Entry vdb-entry x_refsource_bid
http://www.securityfocus.com/bid/67932
Permissions Required, Third Party Advisory third-party-advisory x_refsource_secunia
http://secunia.com/advisories/58691

Scores

EPSS 0.0239
EPSS Percentile 81.9%

Details

CWE
CWE-79
Status published
Products (7)
pypi/Djblets 0 - 0.7.30PyPI
reviewboard/djblets 0.7.27
reviewboard/djblets 0.7.28
reviewboard/djblets 0.8.1
reviewboard/djblets 0.8.2
reviewboard/djblets < 0.7.29
reviewboard/reviewboard
Published Jun 16, 2014
Tracked Since Feb 18, 2026