devel/viewvc-devel is vulnerable to cross-site scripting

2023-01-0400:00:00

vuxml.freebsd.org

viewvc-devel

cross-site scripting

security fix

escape

revision view

copy paths

cve-2023-22464

changed paths

cve-2023-22456

unix

CVSS3

6.1

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

EPSS

0.001

Percentile

42.0%

JSON

C. Michael Pilato reports:

security fix: escape revision view copy paths (#311) [CVE-2023-22464]

security fix: escape revision view changed paths (#311) [CVE-2023-22456]

OSVersionArchitecturePackageVersionFilename
FreeBSDanynoarchpy37-viewvc-devel< 1.3.0.20230104UNKNOWN
FreeBSDanynoarchpy38-viewvc-devel< 1.3.0.20230104UNKNOWN
FreeBSDanynoarchpy39-viewvc-devel< 1.3.0.20230104UNKNOWN

OS	Version	Architecture	Package	Version	Filename
FreeBSD	any	noarch	py37-viewvc-devel	< 1.3.0.20230104	UNKNOWN
FreeBSD	any	noarch	py38-viewvc-devel	< 1.3.0.20230104	UNKNOWN
FreeBSD	any	noarch	py39-viewvc-devel	< 1.3.0.20230104	UNKNOWN