ViewVC up to 1.1.27/1.2.0 CVS show_subdir_lastmod cross site scripting

Summaryinfo

A vulnerability marked as problematic has been reported in ViewVC up to 1.1.27/1.2.0. Affected is an unknown function of the component CVS show_subdir_lastmod. The manipulation leads to cross site scripting. This vulnerability is listed as CVE-2020-5283. The attack may be initiated remotely. There is no available exploit. It is suggested to upgrade the affected component.

Detailsinfo

A vulnerability, which was classified as problematic, has been found in ViewVC up to 1.1.27/1.2.0. This issue affects an unknown code of the component CVS show_subdir_lastmod. The manipulation with an unknown input leads to a cross site scripting vulnerability. Using CWE to declare the problem leads to CWE-80. The product receives input from an upstream component, but it does not neutralize or incorrectly neutralizes special characters such as "<", ">", and "&" that could be interpreted as web-scripting elements when they are sent to a downstream component that processes web pages. Impacted is integrity. The summary by CVE is:

ViewVC before versions 1.1.28 and 1.2.1 has a XSS vulnerability in CVS show_subdir_lastmod support. The impact of this vulnerability is mitigated by the need for an attacker to have commit privileges to a CVS repository exposed by an otherwise trusted ViewVC instance that also has the `show_subdir_lastmod` feature enabled. The attack vector involves files with unsafe names (names that, when embedded into an HTML stream, would cause the browser to run unwanted code), which themselves can be challenging to create. This vulnerability is patched in versions 1.2.1 and 1.1.28.

The weakness was presented 04/03/2020 (GitHub Repository). It is possible to read the advisory at github.com. The identification of this vulnerability is CVE-2020-5283 since 01/02/2020. The attack may be initiated remotely. Additional levels of successful authentication are necessary for exploitation. It demands that the victim is doing some kind of user interaction. The technical details are unknown and an exploit is not publicly available. The attack technique deployed by this issue is T1059.007 according to MITRE ATT&CK.

The vulnerability scanner Nessus provides a plugin with the ID 261354 (Linux Distros Unpatched Vulnerability : CVE-2020-5283), which helps to determine the existence of the flaw in a target environment.

Upgrading to version 1.1.28 or 1.2.1 eliminates this vulnerability.

The vulnerability is also documented in the vulnerability database at Tenable (261354). Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Productinfo

Name

• ViewVC

Version

• 1.0
• 1.1
• 1.1.0
• 1.1.1
• 1.1.2
• 1.1.3
• 1.1.4
• 1.1.5
• 1.1.6
• 1.1.7
• 1.1.8
• 1.1.9
• 1.1.10
• 1.1.11
• 1.1.12
• 1.1.13
• 1.1.14
• 1.1.15
• 1.1.16
• 1.1.17
• 1.1.18
• 1.1.19
• 1.1.20
• 1.1.21
• 1.1.22
• 1.1.23
• 1.1.24
• 1.1.25
• 1.1.26
• 1.1.27
• 1.2.0

License

• open-source

Website

• Product: https://github.com/viewvc/viewvc/

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Discussion