PT-2017-6635 · Beaker · Beaker

Dan Callaghan · Published 2017-09-06 · Updated 2017-09-10 · CVE-2015-3161

Positive Technologies (AI Summary)

CVSS v2.0

3.5

Low

Base vector

AV:N/AC:M/Au:S/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions Beaker versions prior to 20.1

Description The issue concerns the search bar code in the bkr/server/widgets.py file, which fails to escape tags in string literals when producing JSON. This could potentially lead to security issues.

Recommendations For versions prior to 20.1, update to version 20.1 or later to resolve the issue.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2015-3161

Affected Products

Beaker

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2015-3161 · Security Note
• https://bugzilla.redhat.com/attachment.cgi?id=1020004 · Patch
• https://beaker-project.org/jenkins-results/beaker-review-checks-docs/995/documentation/_build/html/whats-new/release-20.html · Vendor Advisory
• https://bugzilla.redhat.com/show_bug.cgi?id=1215024 · Patch
• http://openwall.com/lists/oss-security/2015/05/08/1 · Note
• http://securityfocus.com/bid/74574 · Note