Lucene search

K
mageiaGentoo FoundationMGASA-2023-0019
HistoryJan 24, 2023 - 10:58 a.m.

Updated viewvc packages fix security vulnerability

2023-01-2410:58:25
Gentoo Foundation
advisories.mageia.org
33
viewvc
packages
fix
security
vulnerability
cross-site scripting
impact
commit privileges
subversion repository
attack vector
unsafe names
browser
unwanted code
cve-2023-22456
cve-2023-22464
unix

CVSS3

6.1

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

EPSS

0.001

Percentile

42.0%

ViewVC is vulnerable to cross-site scripting. The impact of these vulnerabilities is mitigated by the need for an attacker to have commit privileges to a Subversion repository exposed by an otherwise trusted ViewVC instance. The attack vector involves files with unsafe names (names that, when embedded into an HTML stream, would cause the browser to run unwanted code), which themselves can be challenging to create. (CVE-2023-22456, CVE-2023-22464)

OSVersionArchitecturePackageVersionFilename
Mageia8noarchviewvc< 1.3.0-0.dev20200516.1.1viewvc-1.3.0-0.dev20200516.1.1.mga8

CVSS3

6.1

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

EPSS

0.001

Percentile

42.0%