PT-2011-1048 · Viewvc · Viewvc

Nicolás Alvarez · Publicado 2011-05-23 · Atualizado 2023-02-13 · CVE-2012-4533

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Média

Vetor base

AV:N/AC:L/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions ViewVC versions 1.0.x through 1.0.12 ViewVC versions 1.1.x through 1.1.15

Description The issue allows remote authenticated users with repository commit access to inject arbitrary web script or HTML. This can be achieved via the function name line in the extra details in the DiffSource. get row function in lib/viewvc.py. The vulnerability may lead to a breach of protected information and can be exploited remotely.

Recommendations For ViewVC versions 1.0.x through 1.0.12, update to version 1.0.13 or later. For ViewVC versions 1.1.x through 1.1.15, update to version 1.1.16 or later.

Correção

XSS

Enumeração de Fraquezas

CWE-399

CWE-79

Identificadores relacionados

BDU:2015-03044

CVE-2012-4533

DSA-2563-1

Produtos afetados

Viewvc

Referências · 27

• http://mandriva.com/security/advisories?name=MDVSA-2013:134 · Aviso do Fabricante
• http://viewvc.tigris.org/source/browse/viewvc?view=rev&revision=2792 · Nota
• https://cve.org/CVERecord?id=CVE-2012-4533 · Nota de Segurança
• https://bdu.fstec.ru/vul/2015-03044 · Nota de Segurança
• http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=691062 · Nota
• http://openwall.com/lists/oss-security/2012/10/21/2 · Nota
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-5024 · Nota de Segurança
• http://securityfocus.com/bid/56161 · Nota
• http://viewvc.tigris.org/issues/show_bug.cgi?id=515 · Nota
• http://osvdb.org/86566 · Nota
• https://ubuntu.com/security/CVE-2012-4533 · Aviso do Fabricante
• http://viewvc.tigris.org/source/browse/%2Acheckout%2A/viewvc/tags/1.0.13/CHANGES · Nota
• https://exchange.xforce.ibmcloud.com/vulnerabilities/79561 · Nota
• http://openwall.com/lists/oss-security/2012/10/21/3 · Nota
• http://viewvc.tigris.org/source/browse/%2Acheckout%2A/viewvc/tags/1.1.16/CHANGES · Nota