GHSA-w7rq-8f2g-jvqr

Source

https://github.com/advisories/GHSA-w7rq-8f2g-jvqr

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/05/GHSA-w7rq-8f2g-jvqr/GHSA-w7rq-8f2g-jvqr.json

JSON Data

https://api.test.osv.dev/v1/vulns/GHSA-w7rq-8f2g-jvqr

Aliases

CVE-2014-3994
PYSEC-2014-78

Published

2022-05-17T03:50:02Z

Modified

2024-09-20T17:46:14.147665Z

Severity

6.1 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N CVSS Calculator
5.3 (Medium) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N CVSS Calculator

Summary

Djiblets Cross-site scripting Vulnerability via JSON Objects

Details

A cross-site scripting (XSS) vulnerability in util/templatetags/djblets_js.py in Djblets before 0.7.30 and 0.8.x before 0.8.3 for Django, as used in Review Board, allows remote attackers to inject arbitrary web script or HTML via a JSON object, as demonstrated by the name field when changing a user name.

Database specific

{
    "severity": "MODERATE",
    "cwe_ids": [
        "CWE-79"
    ],
    "nvd_published_at": "2014-06-16T18:55:00Z",
    "github_reviewed_at": "2023-08-16T22:22:45Z",
    "github_reviewed": true
}

References

Affected packages

PyPI / djblets

Package

Name: djblets; View open source insights on deps.dev
Purl: pkg:pypi/djblets

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

0.7.30

Affected versions

0.*

0.5rc2

0.5

0.5.1

0.5.2

0.5.3

0.5.4

0.5.5

0.5.6

0.5.7

0.5.8

0.5.9

0.6

0.6.1

0.6.2

0.6.3

0.6.4

0.6.5

0.6.6

0.6.7

0.6.8

0.6.9

0.6.10

0.6.11

0.6.12

0.6.13

0.6.14

0.6.15

0.6.16

0.6.17

0.6.18

0.6.19

0.6.20

0.6.21

0.6.22

0.6.23

0.6.24

0.6.25

0.6.26

0.6.27

0.6.28

0.6.29

0.6.30

0.6.31

0.7

0.7.1

0.7.2

0.7.3

0.7.4

0.7.5

0.7.6

0.7.7

0.7.8

0.7.9

0.7.10

0.7.11

0.7.12

0.7.13

0.7.14

0.7.15

0.7.16

0.7.17

0.7.18

0.7.19

0.7.20

0.7.21

0.7.22

0.7.23

0.7.24

0.7.25

0.7.26

0.7.27

0.7.28

0.7.29

Database specific

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/05/GHSA-w7rq-8f2g-jvqr/GHSA-w7rq-8f2g-jvqr.json"