Follow @Openwall on Twitter for new release announcements and other news
[<prev] [next>] [thread-next>] [day] [month] [year] [list]
Date: Tue, 15 Nov 2011 14:51:52 +0100
From: Jan Lieskovsky <>
To: "Steven M. Christey" <>
CC:, Christian Hammond <>
Subject: CVE Request -- ReviewBoard v1.5.7 && v1.6.3 -- XSS in the commenting
 system (diff viewer and screenshot pages components)

Hello Kurt, Steve, vendors,

   a cross-site scripting (XSS) flaw was found in the way the commenting
system of the ReviewBoard, a web-based code review tool, sanitized user
input (new comments to be loaded). A remote attacker could provide a
specially-crafted URL, which once visited by valid ReviewBoard user
could lead to arbitrary HTML or web script execution in the 'diff
viewer' or 'screenshot pages' components.


Relevant upstream patch:

Could you allocate a CVE id for this?

Thank you && Regards, Jan.
Jan iankko Lieskovsky / Red Hat Security Response Team

P.S.: Cc-ed Christian Hammond, who committed change [4] to the
       upstream Git repository too, so they could update CVE id
       in their advisory, if / where needed.

Powered by blists - more mailing lists

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.