CVE-2010-0736

2022-10-0316:21:10

CWE-79

[email protected]

web.nvd.nist.gov

cve-2010-0736

cross-site scripting

xss

vulnerability

view_queryform

lib/viewvc.py

nvd

5.5 Medium

AI Score

Confidence

High

4.3 Medium

CVSS2

Access Vector

Access Complexity

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:N/C:N/I:P/A:N

0.001 Low

EPSS

Percentile

49.8%

JSON

Cross-site scripting (XSS) vulnerability in the view_queryform function in lib/viewvc.py in ViewVC before 1.0.10, and 1.1.x before 1.1.4, allows remote attackers to inject arbitrary web script or HTML via “user-provided input.”

Affected configurations

NVD

Node

viewvcviewvcRange≤1.0.9

viewvcviewvcMatch1.0.1

viewvcviewvcMatch1.0.2

viewvcviewvcMatch1.0.3

viewvcviewvcMatch1.0.4

viewvcviewvcMatch1.0.5

viewvcviewvcMatch1.0.6

viewvcviewvcMatch1.0.7

viewvcviewvcMatch1.0.8

viewvcviewvcMatch1.1.0

viewvcviewvcMatch1.1.1

viewvcviewvcMatch1.1.2

viewvcviewvcMatch1.1.3

CPENameOperatorVersion
viewvc:viewvcviewvcle1.0.9
viewvc:viewvcviewvceq1.0.1
viewvc:viewvcviewvceq1.0.2
viewvc:viewvcviewvceq1.0.3
viewvc:viewvcviewvceq1.0.4
viewvc:viewvcviewvceq1.0.5
viewvc:viewvcviewvceq1.0.6
viewvc:viewvcviewvceq1.0.7
viewvc:viewvcviewvceq1.0.8
viewvc:viewvcviewvceq1.1.0

CPE	Name	Operator	Version
viewvc:viewvc	viewvc	le	1.0.9
viewvc:viewvc	viewvc	eq	1.0.1
viewvc:viewvc	viewvc	eq	1.0.2
viewvc:viewvc	viewvc	eq	1.0.3
viewvc:viewvc	viewvc	eq	1.0.4
viewvc:viewvc	viewvc	eq	1.0.5
viewvc:viewvc	viewvc	eq	1.0.6
viewvc:viewvc	viewvc	eq	1.0.7
viewvc:viewvc	viewvc	eq	1.0.8
viewvc:viewvc	viewvc	eq	1.1.0