VDB
CVE-2020-5283
CVE-2020-5283
PUBLISHED
CVSS 3.0999999046325684 LOW
ViewVC before versions 1.1.28 and 1.2.1 has a XSS vulnerability in CVS show_subdir_lastmod support. The impact of this vulnerability is mitigated by the need for an attacker to have commit privileges to a CVS repository exposed by an otherwise trusted ViewVC instance that also has the `show_subdir_lastmod` feature enabled. The attack vector involves files with unsafe names (names that, when embedded into an HTML stream, would cause the browser to run unwanted code), which themselves can be challenging to create. This vulnerability is patched in versions 1.2.1 and 1.1.28.
EPSS 1.36% · 71.5th percentile
Risk Scores
CVSS 3.1
3.0999999046325684
CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:L/I:L/A:N
EPSS Score
1.36%
71.5th percentile
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Ubuntu:16.04:LTS | viewvc | 0, 1.1.22-1+deb8u1build0.16.04.1, 1.1.22-1 |
| Ubuntu:18.04:LTS | viewvc | 0, 1.1.26-1 |
Timeline
- Apr 3, 2020 CVE Published
- Apr 14, 2021 EPSS Score
- Jun 23, 2021 EPSS Score
- Aug 26, 2021 EPSS Score
- Dec 30, 2021 EPSS Score
- Jan 6, 2022 EPSS Score
- Feb 4, 2022 EPSS Score
- Mar 4, 2022 EPSS Score
- Apr 1, 2022 EPSS Score
- May 6, 2022 EPSS Score
- Sep 10, 2022 EPSS Score
- Nov 13, 2022 EPSS Score
References
- https://github.com/viewvc/viewvc/security/advisories/GHSA-xpxf-fvqv-7mfg third-party-advisory
- https://www.cve.org/CVERecord?id=CVE-2020-5283 third-party-advisory
- https://ubuntu.com/security/CVE-2020-5283 advisory
- https://github.com/viewvc/viewvc/commit/ad0f966e9a997b17d853a6972ea283d4dcd70fa8 fix
- https://github.com/viewvc/viewvc/issues/211 discussion