PT-2013-3599 · Beanbag · Review Board

Craig Young · Publicado 2013-07-31 · Atualizado 2022-05-17 · CVE-2013-2209

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Média

Vetor base

AV:N/AC:H/PR:N/UI:R/S:C/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions Review Board versions 1.6.x through 1.6.16 Review Board versions 1.7.x through 1.7.9

Description A cross-site scripting (XSS) issue exists in the auto-complete widget, allowing remote attackers to inject arbitrary web script or HTML via a full name. This is due to a vulnerability in the htdocs/media/rb/js/reviews.js file.

Recommendations For Review Board versions 1.6.x through 1.6.16, update to version 1.6.17 or later. For Review Board versions 1.7.x through 1.7.9, update to version 1.7.10 or later.

Exploit

Correção

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

CVE-2013-2209

GHSA-6G7X-4C7M-G63M

Produtos afetados

Review Board

Referências · 10

• 🔥 https://github.com/reviewboard/reviewboard/commit/4aaacbb1e628a80803ba1a55703db38fccdf7dbf · Exploit
• https://github.com/reviewboard/reviewboard · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2013-2209 · Nota de Segurança
• http://reviewboard.org/news/2013/06/22/review-board-1617-and-1710-released · Aviso do Fabricante
• http://tripwire.com/state-of-security/vulnerability-management/vulnerabilities-its-time-to-review-your-reviewboard · Nota
• https://osv.dev/vulnerability/GHSA-6g7x-4c7m-g63m · Aviso do Fabricante
• https://bugzilla.redhat.com/show_bug.cgi?id=977423 · Nota
• http://reviewboard.org/docs/releasenotes/reviewboard/1.7.10 · Nota
• http://reviewboard.org/docs/releasenotes/reviewboard/1.6.17 · Nota
• http://openwall.com/lists/oss-security/2013/06/24/2 · Nota