NVD Vulnerability Detail

CVE-2012-4533

Summary	Cross-site scripting (XSS) vulnerability in the "extra" details in the DiffSource._get_row function in lib/viewvc.py in ViewVC 1.0.x before 1.0.13 and 1.1.x before 1.1.16 allows remote authenticated users with repository commit access to inject arbitrary web script or HTML via the "function name" line.
Publication Date	Nov. 19, 2012, 9:55 a.m.
Registration Date	Jan. 28, 2021, 3:03 p.m.
Last Update	Nov. 21, 2024, 10:43 a.m.

CVSS2.0 : MEDIUM
Score	4.3
Vector	AV:N/AC:M/Au:N/C:N/I:P/A:N
攻撃元区分(AV)	ネットワーク
攻撃条件の複雑さ(AC)	中
攻撃前の認証要否(Au)	不要
機密性への影響(C)	なし
完全性への影響(I)	低
可用性への影響(A)	なし
Get all privileges.	いいえ
Get user privileges	いいえ
Get other privileges	いいえ
User operation required	はい

Affected software configurations

Configuration1	or higher	or less	more than	less than
cpe:2.3:a:viewvc:viewvc::::::::	1.0.0			1.0.13
cpe:2.3:a:viewvc:viewvc::::::::	1.1.0			1.1.16

Configuration2	or higher	or less	more than	less than
cpe:2.3:o:debian:debian_linux:7.0:::::::*
cpe:2.3:o:debian:debian_linux:6.0:::::::*

Related information, measures and tools

No	URL	タグ
1	http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=691062	Issue Tracking Mailing List Third Party Advisory
2	http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=691062	Issue Tracking Mailing List Third Party Advisory
3	http://osvdb.org/86566	Broken Link
4	http://osvdb.org/86566	Broken Link
5	http://secunia.com/advisories/51041	Third Party Advisory
6	http://secunia.com/advisories/51041	Third Party Advisory
7	http://secunia.com/advisories/51072	Third Party Advisory
8	http://secunia.com/advisories/51072	Third Party Advisory
9	http://viewvc.tigris.org/issues/show_bug.cgi?id=515	Third Party Advisory
10	http://viewvc.tigris.org/issues/show_bug.cgi?id=515	Third Party Advisory
11	http://viewvc.tigris.org/source/browse/%2Acheckout%2A/viewvc/tags/1.0.13/CHANGES
12	http://viewvc.tigris.org/source/browse/%2Acheckout%2A/viewvc/tags/1.0.13/CHANGES
13	http://viewvc.tigris.org/source/browse/%2Acheckout%2A/viewvc/tags/1.1.16/CHANGES
14	http://viewvc.tigris.org/source/browse/%2Acheckout%2A/viewvc/tags/1.1.16/CHANGES
15	http://viewvc.tigris.org/source/browse/viewvc?view=rev&revision=2792	Third Party Advisory
16	http://viewvc.tigris.org/source/browse/viewvc?view=rev&revision=2792	Third Party Advisory
17	http://viewvc.tigris.org/source/browse/viewvc?view=rev&revision=2794	Third Party Advisory
18	http://viewvc.tigris.org/source/browse/viewvc?view=rev&revision=2794	Third Party Advisory
19	http://www.debian.org/security/2012/dsa-2563	Third Party Advisory
20	http://www.debian.org/security/2012/dsa-2563	Third Party Advisory
21	http://www.mandriva.com/security/advisories?name=MDVSA-2013:134	Third Party Advisory
22	http://www.mandriva.com/security/advisories?name=MDVSA-2013:134	Third Party Advisory
23	http://www.openwall.com/lists/oss-security/2012/10/21/2	Mailing List Third Party Advisory
24	http://www.openwall.com/lists/oss-security/2012/10/21/2	Mailing List Third Party Advisory
25	http://www.openwall.com/lists/oss-security/2012/10/21/3	Mailing List Third Party Advisory
26	http://www.openwall.com/lists/oss-security/2012/10/21/3	Mailing List Third Party Advisory
27	http://www.securityfocus.com/bid/56161	Third Party Advisory VDB Entry
28	http://www.securityfocus.com/bid/56161	Third Party Advisory VDB Entry
29	https://exchange.xforce.ibmcloud.com/vulnerabilities/79561	Third Party Advisory VDB Entry
30	https://exchange.xforce.ibmcloud.com/vulnerabilities/79561	Third Party Advisory VDB Entry
31	https://wiki.mageia.org/en/Support/Advisories/MGASA-2012-0313	Third Party Advisory
32	https://wiki.mageia.org/en/Support/Advisories/MGASA-2012-0313	Third Party Advisory

Common Vulnerabilities List

No	CWE	Name	URL
1	CWE-79	クロスサイト・スクリプティング（XSS）	https://cwe.mitre.org/data/definitions/79.html

JVN Vulnerability Information

ViewVC の lib/viewvc.py におけるクロスサイトスクリプティングの脆弱性

Title	ViewVC の lib/viewvc.py におけるクロスサイトスクリプティングの脆弱性
Summary	ViewVC の lib/viewvc.py 内の DiffSource._get_row 関数の余計な詳細 (extra details) には、クロスサイトスクリプティングの脆弱性が存在します。
Possible impacts	リポジトリへのコミットアクセス権を持つリモート認証されたユーザにより、"関数名 (function name)" の行を介して、任意の Web スクリプトまたは HTML を挿入される可能性があります。
Solution	ベンダより正式な対策が公開されています。ベンダ情報を参照して適切な対策を実施してください。
Publication Date	Oct. 24, 2012, midnight
Registration Date	Nov. 20, 2012, 5:43 p.m.
Last Update	Nov. 30, 2012, 6:09 p.m.

Affected System

ViewVC

ViewVC 1.0.13 未満の 1.0.x

ViewVC 1.1.16 未満の 1.1.x

CVE (情報セキュリティ共通脆弱性識別子)

No	Name	URL
Common Vulnerabilities and Exposures (CVE)
1	CVE-2012-4533	http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-4533
National Vulnerability Database (NVD)
2	CVE-2012-4533	http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2012-4533

CWE (共通脆弱性タイプ一覧)

No	Name	URL
JVNDB
1	CWE-79	https://jvndb.jvn.jp/ja/cwe/CWE-79.html

ベンダー情報

No	Name	URL
Debian Bug report logs
1	#691062	http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=691062
Debian Security Advisory
2	DSA-2563	http://www.debian.org/security/2012/dsa-2563
viewvc
3	Issue 515	http://viewvc.tigris.org/issues/show_bug.cgi?id=515
4	Subversion: revision=2792	http://viewvc.tigris.org/source/browse/viewvc?view=rev&revision=2792
5	Subversion: revision=2794	http://viewvc.tigris.org/source/browse/viewvc?view=rev&revision=2794
6	Top Page	http://www.viewvc.org/
7	Version 1.0.13 (released 24-Oct-2012)	http://viewvc.tigris.org/source/browse/checkout/viewvc/tags/1.0.13/CHANGES
8	Version 1.1.16	http://viewvc.tigris.org/source/browse/checkout/viewvc/tags/1.1.16/CHANGES

Change Log

No	Changed Details	Date of change
0	[2012年11月20日] 掲載 [2012年11月30日] タイトル：内容を更新概要：内容を更新	Feb. 17, 2018, 10:37 a.m.