Unscored severity · published Apr 2, 2003
CVE-2003-0154
Cross-site scripting vulnerabilities (XSS) in bonsai Mozilla CVS query tool allow remote attackers to execute arbitrary web script via (1) the file, root, or rev parameters to…
–
CVSS
4.6%
EPSS
No
On KEV
Description
Cross-site scripting vulnerabilities (XSS) in bonsai Mozilla CVS query tool allow remote attackers to execute arbitrary web script via (1) the file, root, or rev parameters to cvslog.cgi, (2) the file or root parameters to cvsblame.cgi, (3) various parameters to cvsquery.cgi, (4) the person parameter to showcheckins.cgi, (5) the module parameter to cvsqueryform.cgi, and (6) possibly other attack vectors as identified by Mozilla bug #146244.
Exploitation
Is it being used?
Exploit prediction (EPSS)4.6% · higher than 92% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
BO
Bonsai · Mozilla
1.3 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2003-0154
CVE.org
https://www.cve.org/CVERecord?id=CVE-2003-0154
bugzilla.mozilla.org
http://bugzilla.mozilla.org/attachment.cgi?id=95950&action=view
bugzilla.mozilla.org
http://bugzilla.mozilla.org/attachment.cgi?id=95985&action=view
bugzilla.mozilla.org
http://bugzilla.mozilla.org/show_bug.cgi?id=146244
bugzilla.mozilla.org
http://bugzilla.mozilla.org/show_bug.cgi?id=163573
marc.info
http://marc.info/?l=bugtraq&m=102980129101054&w=2
Patch
http://www.debian.org/security/2003/dsa-265
More from Bonsai
–
CVE-2003-0152
Unknown vulnerability in bonsai Mozilla CVS query tool allows remote attackers to execute arbitrary commands as the www-data user
–
CVE-2003-0153
bonsai Mozilla CVS query tool leaks the absolute pathname of the tool in certain error messages generated by (1) cvslog.cgi, (2) cvsview2.cgi, or (3) multidiff.cgi
–
CVE-2003-0155
bonsai Mozilla CVS query tool allows remote attackers to gain access to the parameters page without authentication