Vulnerability Description
ViewVC before versions 1.1.28 and 1.2.1 has a XSS vulnerability in CVS show_subdir_lastmod support. The impact of this vulnerability is mitigated by the need for an attacker to have commit privileges to a CVS repository exposed by an otherwise trusted ViewVC instance that also has the `show_subdir_lastmod` feature enabled. The attack vector involves files with unsafe names (names that, when embedded into an HTML stream, would cause the browser to run unwanted code), which themselves can be challenging to create. This vulnerability is patched in versions 1.2.1 and 1.1.28.
CVSS Score
LOW
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Viewvc | Viewvc | < 1.1.28 |
Related Weaknesses (CWE)
References
- https://github.com/viewvc/viewvc/commit/ad0f966e9a997b17d853a6972ea283d4dcd70fa8PatchThird Party Advisory
- https://github.com/viewvc/viewvc/issues/211ExploitIssue TrackingThird Party Advisory
- https://github.com/viewvc/viewvc/security/advisories/GHSA-xpxf-fvqv-7mfgMitigationPatchThird Party Advisory
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedorapro
- https://github.com/viewvc/viewvc/commit/ad0f966e9a997b17d853a6972ea283d4dcd70fa8PatchThird Party Advisory
- https://github.com/viewvc/viewvc/issues/211ExploitIssue TrackingThird Party Advisory
- https://github.com/viewvc/viewvc/security/advisories/GHSA-xpxf-fvqv-7mfgMitigationPatchThird Party Advisory
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedorapro
FAQ
What is CVE-2020-5283?
CVE-2020-5283 is a vulnerability with a CVSS score of 3.1 (LOW). ViewVC before versions 1.1.28 and 1.2.1 has a XSS vulnerability in CVS show_subdir_lastmod support. The impact of this vulnerability is mitigated by the need for an attacker to have commit privileges ...
How severe is CVE-2020-5283?
CVE-2020-5283 has been rated LOW with a CVSS base score of 3.1/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2020-5283?
Check the references section above for vendor advisories and patch information. Affected products include: Viewvc Viewvc.