Date: Mon, 24 Jun 2013 10:46:59 -0400 (EDT) From: Jan Lieskovsky <jlieskov@...hat.com> To: oss-security@...ts.openwall.com Cc: "Steven M. Christey" <coley@...us.mitre.org>, Stephen Gallagher <sgallagh@...hat.com> Subject: CVE Request -- Review Board: Stored XSS due improper sanitization of user's full name in the reviews dropdown (fixed in upstream v1.7.10, v1.6.17 versions) Hello Kurt, Steve, vendors, A persistent / stored cross-site scripting (XSS) flaw was found in the way reviews dropdown of Review Board, a web-based code review tool, performed sanitization of certain user information (full name). A remote attacker could provide a specially-crafted URL that, when visited would lead to arbitrary HTML or web script execution in the context of Review Board user's session. References:  http://www.reviewboard.org/docs/releasenotes/reviewboard/1.7.10/  http://www.reviewboard.org/docs/releasenotes/reviewboard/1.6.17/  http://www.reviewboard.org/news/2013/06/22/review-board-1617-and-1710-released/  https://bugzilla.redhat.com/show_bug.cgi?id=977423 Upstream patch:  https://github.com/reviewboard/reviewboard/commit/4aaacbb1e628a80803ba1a55703db38fccdf7dbf Upstream acknowledges Craig Young at Tripwire as the original issue reporter. Can you allocate a CVE identifier for this? Thank you && Regards, Jan. -- Jan iankko Lieskovsky / Red Hat Security Response Team
Powered by blists - more mailing lists
Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.
Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.