CVE-2011-4312 — Cross-site Scripting in Review Board

CWE-79 — Cross-site Scripting4 documents3 sources
Severity
4.3MEDIUMNVD
EPSS
0.6%
top 31.80%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
1
Reviewboard Review Board
Timeline
PublishedNov 24
Latest updateMay 17

Description

Multiple cross-site scripting (XSS) vulnerabilities in the commenting system in Review Board before 1.5.7 and 1.6.x before 1.6.3 allow remote attackers to inject arbitrary web script or HTML via vectors involving the (1) diff viewer or (2) screenshot component.

CVSS vector

AV:N/AC:M/C:N/I:P/A:NExploitability: 8.6 | Impact: 2.9

Affected Packages1 packages

Patches

Patch: github.com ↗Patch: github.com ↗

🔴Vulnerability Details

1
GHSA
GHSA-4cwr-57j7-96p4: Multiple cross-site scripting (XSS) vulnerabilities in the commenting system in Review Board before 1↗2022-05-17
▶

💬Community

2
Bugzilla
CVE-2011-4312 ReviewBoard: XSS in the commenting system (diff viewer and screenshot pages) [fedora-all]↗2011-11-15
▶
Bugzilla
CVE-2011-4312 ReviewBoard: XSS in the commenting system (diff viewer and screenshot pages)↗2011-11-15
▶