PT-2019-12082 · Roundup · Roundup

Hanno Böck · Published 2019-04-06 · Updated 2019-04-09 · CVE-2019-10904

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Roundup version 1.6

Description The issue allows for XSS via the URI due to mishandling of 404 errors by frontends/roundup.cgi and roundup/cgi/wsgi handler.py.

Recommendations For Roundup version 1.6, consider updating to a newer version that addresses this issue, or as a temporary workaround, restrict access to the vulnerable frontend and backend scripts to minimize the risk of exploitation.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2019-10904

DLA-1750-1

GHSA-926Q-WXR6-3CRQ

PYSEC-2019-201

Affected Products

Roundup

References · 19

• 🔥 https://github.com/python/bugs.python.org/issues/34 · Exploit
• 🔥 http://openwall.com/lists/oss-security/2019/04/07/1 · Exploit
• 🔥 https://bugs.python.org/issue36391 · Exploit
• https://osv.dev/vulnerability/CVE-2019-10904 · Vendor Advisory
• https://ubuntu.com/security/CVE-2019-10904 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-926q-wxr6-3crq · Vendor Advisory
• https://osv.dev/vulnerability/PYSEC-2019-201 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2019-10904 · Vendor Advisory
• https://osv.dev/vulnerability/DLA-1750-1 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2019-10904 · Security Note
• https://cve.org/CVERecord?id=CVE-2019-10904 · Security Note
• https://github.com/pypa/advisory-database/tree/main/vulns/roundup/PYSEC-2019-201.yaml · Note
• https://github.com/roundup-tracker/roundup · Note
• https://openwall.com/lists/oss-security/2019/04/05/1 · Note
• https://bitbucket.org/python/roundup/commits/51682dc2cd7e28421d749117c25bec58f632ee5f · Note