CVE-2019-10904

🗓️ 06 Apr 2019 19:40:05Reported by mitreType

cve🔗 web.nvd.nist.gov👁 105 Views🌐 WEB

Roundup 1.6 allows XSS via the URI because of mishandling 404 errors

Reporter	Title	Published	Views	Family All 20
CNVD	Roundup cross-site scripting vulnerability (CNVD-2019-09481)	9 Apr 201900:00	–	cnvd
Cvelist	CVE-2019-10904	6 Apr 201919:40	–	cvelist
Debian	[SECURITY] [DLA 1750-1] roundup security update	7 Apr 201912:33	–	debian
Tenable Nessus	Debian DLA-1750-1 : roundup security update	8 Apr 201900:00	–	nessus
EUVD	EUVD-2019-0124	7 Oct 202500:30	–	euvd
Github Security Blog	Moderate severity vulnerability that affects roundup	9 Apr 201919:47	–	github
Mend	CVE-2019-10904	6 Apr 201919:40	–	mend
NVD	CVE-2019-10904	6 Apr 201920:29	–	nvd
OpenVAS	Debian: Security Advisory (DLA-1750-1)	8 Apr 201900:00	–	openvas
osv_cve	CVE-2019-10904	6 Apr 201920:29	–	osv_cve

NVD

Node

debian debian_linuxMatch8.0

Node

roundup-tracker roundupMatch1.6

Source	Link
bugs	www.bugs.python.org/issue36391
github	www.github.com/python/bugs.python.org/issues/34
lists	www.lists.debian.org/debian-lts-announce/2019/04/msg00009.html
openwall	www.openwall.com/lists/oss-security/2019/04/07/1
openwall	www.openwall.com/lists/oss-security/2019/04/05/1

Parameter	Position	Path	Description	CWE
path	path	frontends/roundup.cgi	XSS via URI in Roundup 1.6 due to improper handling of 404 errors in frontends/roundup.cgi.	CWE-79
path	path	roundup/cgi/wsgi_handler.py	XSS via URI in Roundup 1.6 due to improper handling of 404 errors in roundup/cgi/wsgi_handler.py.	CWE-79

17 Jun 2026 02:11Current

5.8Medium risk

Vulners AI Score5.8

CVSS 24.3

CVSS 36.1

EPSS0.01581

roundup 1.6 xss uri mishandling 404 errors