Описание
Cross-site scripting (XSS) vulnerability in util/templatetags/djblets_js.py in Djblets before 0.7.30 and 0.8.x before 0.8.3 for Django, as used in Review Board, allows remote attackers to inject arbitrary web script or HTML via a JSON object, as demonstrated by the name field when changing a user name.
Ссылки
- Third Party AdvisoryVDB Entry
- Third Party AdvisoryVDB Entry
- Permissions RequiredThird Party Advisory
- Third Party AdvisoryVDB Entry
- Not Applicable
- Issue TrackingPatch
- ExploitIssue TrackingPatch
- Issue TrackingPatch
- Third Party AdvisoryVDB Entry
- Third Party AdvisoryVDB Entry
- Permissions RequiredThird Party Advisory
- Third Party AdvisoryVDB Entry
- Not Applicable
- Issue TrackingPatch
- ExploitIssue TrackingPatch
- Issue TrackingPatch
Уязвимые конфигурации
Конфигурация 1Версия до 0.7.29 (включая)
Одно из
cpe:2.3:a:reviewboard:djblets:*:*:*:*:*:*:*:*
cpe:2.3:a:reviewboard:djblets:0.7.27:*:*:*:*:*:*:*
cpe:2.3:a:reviewboard:djblets:0.7.28:*:*:*:*:*:*:*
cpe:2.3:a:reviewboard:djblets:0.8.1:*:*:*:*:*:*:*
cpe:2.3:a:reviewboard:djblets:0.8.2:*:*:*:*:*:*:*
cpe:2.3:a:reviewboard:reviewboard:-:*:*:*:*:*:*:*
EPSS
Процентиль: 69%
0.00588
Низкий
4.3 Medium
CVSS2
Дефекты
CWE-79
Связанные уязвимости
ubuntu
больше 11 лет назад
Cross-site scripting (XSS) vulnerability in util/templatetags/djblets_js.py in Djblets before 0.7.30 and 0.8.x before 0.8.3 for Django, as used in Review Board, allows remote attackers to inject arbitrary web script or HTML via a JSON object, as demonstrated by the name field when changing a user name.
CVSS3: 6.1
github
больше 3 лет назад
Djiblets Cross-site scripting Vulnerability via JSON Objects
EPSS
Процентиль: 69%
0.00588
Низкий
4.3 Medium
CVSS2
Дефекты
CWE-79