CVE-2010-0132

Cross-site scripting (XSS) vulnerability in ViewVC 1.1 before 1.1.5 and 1.0 before 1.0.11, when the regular expression search functionality is enabled, allows remote attackers to inject arbitrary web script or HTML via vectors related to "search_re input," a different vulnerability than CVE-2010-0736.

CVSS v2.0 2.6 LOW

2.6^/10

CVSS v2.0 : LOW

Vector : AV:N/AC:H/Au:N/C:N/I:P/A:N

Exploitability : 4.9 / Impact : 2.9

Access Vector NETWORK

Access Complexity HIGH

Authentication NONE

Confidentiality Impact NONE

Integrity Impact PARTIAL

Availability Impact NONE

References

Link	Resource
http://lists.fedoraproject.org/pipermail/package-announce/2010-April/038420.html
http://lists.fedoraproject.org/pipermail/package-announce/2010-April/038456.html
http://lists.fedoraproject.org/pipermail/package-announce/2010-April/038925.html
http://lists.opensuse.org/opensuse-security-announce/2010-04/msg00002.html
http://secunia.com/advisories/38918	Vendor Advisory
http://secunia.com/secunia_research/2010-26/	Vendor Advisory
http://viewvc.tigris.org/source/browse/viewvc/trunk/CHANGES?r1=2342&r2=2359&pathrev=HEAD
http://www.securityfocus.com/archive/1/510408/100/0/threaded
http://www.vupen.com/english/advisories/2010/0743	Patch Vendor Advisory
http://www.vupen.com/english/advisories/2010/0844

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:viewvc:viewvc:1.0.0:::::::*
	cpe:2.3:a:viewvc:viewvc:1.0.1:::::::*
	cpe:2.3:a:viewvc:viewvc:1.0.2:::::::*
	cpe:2.3:a:viewvc:viewvc:1.0.3:::::::*
	cpe:2.3:a:viewvc:viewvc:1.0.4:::::::*
	cpe:2.3:a:viewvc:viewvc:1.0.5:::::::*
	cpe:2.3:a:viewvc:viewvc:1.0.6:::::::*
	cpe:2.3:a:viewvc:viewvc:1.0.7:::::::*
	cpe:2.3:a:viewvc:viewvc:1.0.8:::::::*
	cpe:2.3:a:viewvc:viewvc:1.0.9:::::::*
	cpe:2.3:a:viewvc:viewvc:1.0.10:::::::*
	cpe:2.3:a:viewvc:viewvc:1.1.0:::::::*
	cpe:2.3:a:viewvc:viewvc:1.1.1:::::::*
	cpe:2.3:a:viewvc:viewvc:1.1.2:::::::*
	cpe:2.3:a:viewvc:viewvc:1.1.3:::::::*
	cpe:2.3:a:viewvc:viewvc:1.1.4:::::::*

History

No history.

Information

Published : 2010-03-31 18:00

Updated : 2023-12-10 11:03

NVD link : CVE-2010-0132

Mitre link : CVE-2010-0132

CVE.ORG link : CVE-2010-0132

JSON object : View

Products Affected

viewvc

viewvc

CWE

CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

{"id": "CVE-2010-0132", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 2.6, "accessVector": "NETWORK", "vectorString": "AV:N/AC:H/Au:N/C:N/I:P/A:N", "authentication": "NONE", "integrityImpact": "PARTIAL", "accessComplexity": "HIGH", "availabilityImpact": "NONE", "confidentialityImpact": "NONE"}, "acInsufInfo": false, "impactScore": 2.9, "baseSeverity": "LOW", "obtainAllPrivilege": false, "exploitabilityScore": 4.9, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": true}]}, "published": "2010-03-31T18:00:00.327", "references": [{"url": "http://lists.fedoraproject.org/pipermail/package-announce/2010-April/038420.html", "source": "PSIRT-CNA@flexerasoftware.com"}, {"url": "http://lists.fedoraproject.org/pipermail/package-announce/2010-April/038456.html", "source": "PSIRT-CNA@flexerasoftware.com"}, {"url": "http://lists.fedoraproject.org/pipermail/package-announce/2010-April/038925.html", "source": "PSIRT-CNA@flexerasoftware.com"}, {"url": "http://lists.opensuse.org/opensuse-security-announce/2010-04/msg00002.html", "source": "PSIRT-CNA@flexerasoftware.com"}, {"url": "http://secunia.com/advisories/38918", "tags": ["Vendor Advisory"], "source": "PSIRT-CNA@flexerasoftware.com"}, {"url": "http://secunia.com/secunia_research/2010-26/", "tags": ["Vendor Advisory"], "source": "PSIRT-CNA@flexerasoftware.com"}, {"url": "http://viewvc.tigris.org/source/browse/viewvc/trunk/CHANGES?r1=2342&r2=2359&pathrev=HEAD", "source": "PSIRT-CNA@flexerasoftware.com"}, {"url": "http://www.securityfocus.com/archive/1/510408/100/0/threaded", "source": "PSIRT-CNA@flexerasoftware.com"}, {"url": "http://www.vupen.com/english/advisories/2010/0743", "tags": ["Patch", "Vendor Advisory"], "source": "PSIRT-CNA@flexerasoftware.com"}, {"url": "http://www.vupen.com/english/advisories/2010/0844", "source": "PSIRT-CNA@flexerasoftware.com"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-79"}]}], "descriptions": [{"lang": "en", "value": "Cross-site scripting (XSS) vulnerability in ViewVC 1.1 before 1.1.5 and 1.0 before 1.0.11, when the regular expression search functionality is enabled, allows remote attackers to inject arbitrary web script or HTML via vectors related to \"search_re input,\" a different vulnerability than CVE-2010-0736."}, {"lang": "es", "value": "Vulnerabilidad de secuencias de comandos en sitios cruzados (XSS) en ViewVC 1.1 en versiones anteriores a la 1.1.5 y 1.0 en versiones anteriores a la 1.0.11, cuando la funcionalidad de b\u00fasqueda con expresiones regulares est\u00e1 habilitada, permite a atacantes remotos inyectar secuencias de comandos web o HTML de su elecci\u00f3n mediante vectores relacionados con \"search_re input,\" una vulnerabilidad diferente a CVE-2010-0736."}], "lastModified": "2018-10-10T19:51:11.603", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:viewvc:viewvc:1.0.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "59DBEDF6-248F-4850-B50C-61835DB89374"}, {"criteria": "cpe:2.3:a:viewvc:viewvc:1.0.1:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "007977CF-1BF9-4713-AFDF-50DEE2530AD5"}, {"criteria": "cpe:2.3:a:viewvc:viewvc:1.0.2:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "793F6DB3-A6C2-4813-BD2D-AF34D85F6CCA"}, {"criteria": "cpe:2.3:a:viewvc:viewvc:1.0.3:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "1B6F2BC5-D099-427C-9513-75551ABF1997"}, {"criteria": "cpe:2.3:a:viewvc:viewvc:1.0.4:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "4748AA05-D2ED-4365-83AE-74CD33592B5D"}, {"criteria": "cpe:2.3:a:viewvc:viewvc:1.0.5:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "91ADB624-1826-405C-BB1E-3D286ED03D5A"}, {"criteria": "cpe:2.3:a:viewvc:viewvc:1.0.6:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "A4AE31C7-1929-48A4-8A3A-860A110E4820"}, {"criteria": "cpe:2.3:a:viewvc:viewvc:1.0.7:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "F71721BF-9010-4595-96F8-CF499B0FFE6D"}, {"criteria": "cpe:2.3:a:viewvc:viewvc:1.0.8:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "96AD0DD2-206B-4231-B09E-9B83F6E0239E"}, {"criteria": "cpe:2.3:a:viewvc:viewvc:1.0.9:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "2A7F4AAD-EB09-47F1-A7B7-5436E766A0C6"}, {"criteria": "cpe:2.3:a:viewvc:viewvc:1.0.10:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "E0D457A6-C530-42AC-9BCF-640A89D9BF5C"}, {"criteria": "cpe:2.3:a:viewvc:viewvc:1.1.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "8ECD4F7E-011C-4E92-9D8E-AC378B204C05"}, {"criteria": "cpe:2.3:a:viewvc:viewvc:1.1.1:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "4FE78493-E4EB-4555-BA56-A29AFE680B56"}, {"criteria": "cpe:2.3:a:viewvc:viewvc:1.1.2:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "C076220E-CFB1-44B0-9884-840F4C5B4F9A"}, {"criteria": "cpe:2.3:a:viewvc:viewvc:1.1.3:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "77350E39-A3A7-463E-BF70-D1BD99F7C23E"}, {"criteria": "cpe:2.3:a:viewvc:viewvc:1.1.4:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "AB57E24E-00A7-4099-8135-64B0E165FEBF"}], "operator": "OR"}]}], "sourceIdentifier": "PSIRT-CNA@flexerasoftware.com"}