oss-security - CVE Request -- ReviewBoard v1.5.7 && v1.6.3 -- XSS in the commenting system (diff viewer and screenshot pages components)

Follow @Openwall on Twitter for new release announcements and other news

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Date: Tue, 15 Nov 2011 14:51:52 +0100
From: Jan Lieskovsky <jlieskov@...hat.com>
To: "Steven M. Christey" <coley@...us.mitre.org>
CC: oss-security@...ts.openwall.com, Christian Hammond <chipx86@...px86.com>
Subject: CVE Request -- ReviewBoard v1.5.7 && v1.6.3 -- XSS in the commenting
 system (diff viewer and screenshot pages components)

Hello Kurt, Steve, vendors,

   a cross-site scripting (XSS) flaw was found in the way the commenting
system of the ReviewBoard, a web-based code review tool, sanitized user
input (new comments to be loaded). A remote attacker could provide a
specially-crafted URL, which once visited by valid ReviewBoard user
could lead to arbitrary HTML or web script execution in the 'diff
viewer' or 'screenshot pages' components.

References:
[1] http://www.reviewboard.org/news/
[2] http://www.reviewboard.org/docs/releasenotes/dev/reviewboard/1.6.3/
[3] https://bugzilla.redhat.com/show_bug.cgi?id=754126

Relevant upstream patch:
[4] 
https://github.com/reviewboard/reviewboard/commit/7a0a9d94555502278534dedcf2d75e9fccce8c3d

Could you allocate a CVE id for this?

Thank you && Regards, Jan.
--
Jan iankko Lieskovsky / Red Hat Security Response Team

P.S.: Cc-ed Christian Hammond, who committed change [4] to the
       upstream Git repository too, so they could update CVE id
       in their advisory, if / where needed.

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.