PT-2011-1048 · Viewvc · Viewvc

Nicolás Alvarez · Published 2011-05-23 · Updated 2023-02-13 · CVE-2012-4533

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Medium

Base vector

AV:N/AC:L/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions ViewVC versions 1.0.x through 1.0.12 ViewVC versions 1.1.x through 1.1.15

Description The issue allows remote authenticated users with repository commit access to inject arbitrary web script or HTML. This can be achieved via the function name line in the extra details in the DiffSource. get row function in lib/viewvc.py. The vulnerability may lead to a breach of protected information and can be exploited remotely.

Recommendations For ViewVC versions 1.0.x through 1.0.12, update to version 1.0.13 or later. For ViewVC versions 1.1.x through 1.1.15, update to version 1.1.16 or later.

Fix

XSS

Weakness Enumeration

CWE-399

CWE-79

Related Identifiers

BDU:2015-03044

CVE-2012-4533

DSA-2563-1

Affected Products

Viewvc

References · 27

• http://mandriva.com/security/advisories?name=MDVSA-2013:134 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2012-4533 · Security Note
• https://bdu.fstec.ru/vul/2015-03044 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-5024 · Security Note
• https://ubuntu.com/security/CVE-2012-4533 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-3357 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-4533 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-3356 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2012-4533 · Security Note
• http://debian.org/security/2012/dsa-2563 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2012-4533 · Vendor Advisory
• http://viewvc.tigris.org/source/browse/viewvc?view=rev&revision=2792 · Note
• http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=691062 · Note
• http://openwall.com/lists/oss-security/2012/10/21/2 · Note
• http://securityfocus.com/bid/56161 · Note