Follow @Openwall on Twitter for new release announcements and other news
[<prev] [next>] [thread-next>] [day] [month] [year] [list]
Date: Mon, 24 Jun 2013 10:46:59 -0400 (EDT)
From: Jan Lieskovsky <>
Cc: "Steven M. Christey" <>,
        Stephen Gallagher <>
Subject: CVE Request --  Review Board: Stored XSS due improper sanitization
 of user's full name in the reviews dropdown (fixed in upstream v1.7.10,
  v1.6.17 versions)

Hello Kurt, Steve, vendors,

  A persistent / stored cross-site scripting (XSS) flaw was found in
the way reviews dropdown of Review Board, a web-based code review tool,
performed sanitization of certain user information (full name). A remote
attacker could provide a specially-crafted URL that, when visited would
lead to arbitrary HTML or web script execution in the context of
Review Board user's session.


Upstream patch:

Upstream acknowledges Craig Young at Tripwire as the original issue reporter.

Can you allocate a CVE identifier for this?

Thank you && Regards, Jan.
Jan iankko Lieskovsky / Red Hat Security Response Team

Powered by blists - more mailing lists

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.