CVE Vulnerability

CVE-2019-13122

A Cross Site Scripting (XSS) vulnerability exists in the template tag used to render message ids in Patchwork v1.1 through v2.1.x. This allows an attacker to insert JavaScript or HTML into the patch detail page via an email sent to a mailing list consumed by Patchwork. This affects the function msgid in templatetags/patch.py. Patchwork versions v2.1.4 and v2.0.4 will contain the fix.

4.3 /10

CVSS v2.0 :

V3 Legend

Vector :

Exploitability : 8.6 / Impact : 2.9

Attack Vector

Attack Complexity

Privileges Required

User Interaction

Confidentiality Impact NONE

Integrity Impact PARTIAL

Availability Impact NONE

Scope

6.1 /10

CVSS v3.0 : MEDIUM

V3 Legend

Vector :

Exploitability : 2.8 / Impact : 2.7

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction REQUIRED

Confidentiality Impact LOW

Integrity Impact LOW

Availability Impact NONE

Scope CHANGED

References
Link Resource
http://jk.ozlabs.org/projects/patchwork/ Vendor Advisory
https://lists.ozlabs.org/pipermail/patchwork/2019-July/date.html Vendor Advisory
https://lists.ozlabs.org/pipermail/patchwork/2019-July/005870.html Mailing List Vendor Advisory
https://lists.ozlabs.org/pipermail/patchwork/2019-July/005878.html Mailing List Vendor Advisory
https://github.com/getpatchwork/patchwork/releases Release Notes Third Party Advisory
https://github.com/getpatchwork/patchwork/commits/master Third Party Advisory
http://www.openwall.com/lists/oss-security/2019/07/05/1 Mailing List Third Party Advisory
Configurations

Configuration 1

cpe:2.3:a:ozlabs:patchwork:2.1.0:rc2:*:*:*:*:*:*
cpe:2.3:a:ozlabs:patchwork:2.1.0:rc1:*:*:*:*:*:*
cpe:2.3:a:ozlabs:patchwork:*:*:*:*:*:*:*:*
cpe:2.3:a:ozlabs:patchwork:*:*:*:*:*:*:*:*
Information

Published : 2019-07-10 05:15

Updated : 2019-07-16 04:48

NVD link : CVE-2019-13122

Mitre link : CVE-2019-13122

Products Affected
No products.
CWE
CWE-79