CVE-2014-5027 — Cross-site Scripting in Review Board

CWE-79 — Cross-site Scripting4 documents3 sources
Severity
4.3MEDIUMNVD
EPSS
0.5%
top 33.32%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
1
Reviewboard Review Board
Timeline
PublishedJul 25
Latest updateMay 17

Description

Cross-site scripting (XSS) vulnerability in Review Board 1.7.x before 1.7.27 and 2.0.x before 2.0.4 allows remote attackers to inject arbitrary web script or HTML via a query parameter to a diff fragment page.

CVSS vector

AV:N/AC:M/C:N/I:P/A:NExploitability: 8.6 | Impact: 2.9

Affected Packages1 packages

▶NVDreviewboard/review_board32 versions+31

🔴Vulnerability Details

1
GHSA
GHSA-6mg9-jgmx-fc96: Cross-site scripting (XSS) vulnerability in Review Board 1↗2022-05-17
▶

💬Community

2
Bugzilla
CVE-2014-5027 CVE-2014-5028 ReviewBoard: two flaws fixed in the 1.7.27 release [epel-6]↗2014-07-28
▶
Bugzilla
CVE-2014-5027 CVE-2014-5028 ReviewBoard: two flaws fixed in the 1.7.27 release↗2014-07-28
▶