oss-security - CVE Request -- Review Board: Stored XSS due improper sanitization of user's full name in the reviews dropdown (fixed in upstream v1.7.10, v1.6.17 versions)

Follow @Openwall on Twitter for new release announcements and other news

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-ID: <1873121591.25789374.1372085219308.JavaMail.root@redhat.com>
Date: Mon, 24 Jun 2013 10:46:59 -0400 (EDT)
From: Jan Lieskovsky <jlieskov@...hat.com>
To: oss-security@...ts.openwall.com
Cc: "Steven M. Christey" <coley@...us.mitre.org>,
        Stephen Gallagher <sgallagh@...hat.com>
Subject: CVE Request --  Review Board: Stored XSS due improper sanitization
 of user's full name in the reviews dropdown (fixed in upstream v1.7.10,
  v1.6.17 versions)

Hello Kurt, Steve, vendors,

  A persistent / stored cross-site scripting (XSS) flaw was found in
the way reviews dropdown of Review Board, a web-based code review tool,
performed sanitization of certain user information (full name). A remote
attacker could provide a specially-crafted URL that, when visited would
lead to arbitrary HTML or web script execution in the context of
Review Board user's session.

References:
[1] http://www.reviewboard.org/docs/releasenotes/reviewboard/1.7.10/
[2] http://www.reviewboard.org/docs/releasenotes/reviewboard/1.6.17/
[3] http://www.reviewboard.org/news/2013/06/22/review-board-1617-and-1710-released/
[4] https://bugzilla.redhat.com/show_bug.cgi?id=977423

Upstream patch:
[5] https://github.com/reviewboard/reviewboard/commit/4aaacbb1e628a80803ba1a55703db38fccdf7dbf

Upstream acknowledges Craig Young at Tripwire as the original issue reporter.

Can you allocate a CVE identifier for this?

Thank you && Regards, Jan.
--
Jan iankko Lieskovsky / Red Hat Security Response Team

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.