CVE-2014-5027

Reviewboard Review Board - XSS

Title source: rule

Description

Cross-site scripting (XSS) vulnerability in Review Board 1.7.x before 1.7.27 and 2.0.x before 2.0.4 allows remote attackers to inject arbitrary web script or HTML via a query parameter to a diff fragment page.

References (7)

[Mailing List] http://seclists.org/oss-sec/2014/q3/207

[Mailing List] http://seclists.org/oss-sec/2014/q3/219

[Vendor Advisory] https://www.reviewboard.org/docs/releasenotes/reviewboard/1.7.27

[Vendor Advisory] https://www.reviewboard.org/docs/releasenotes/reviewboard/2.0.4

[Vendor Advisory] https://www.reviewboard.org/news/2014/07/22/review-board-1-7-27-and-2-0-3-security-releases

[Third Party Advisory, VDB Entry] http://www.securityfocus.com/bid/68858

[Third Party Advisory] http://secunia.com/advisories/60243

Scores

EPSS 0.0052

EPSS Percentile 66.4%

Details

CWE

CWE-79

Status published

Products (39)

reviewboard/review_board

... and 29 more

Published Jul 25, 2014

Tracked Since Feb 18, 2026