Unscored severity · published Nov 24, 2011
CVE-2011-4312
Multiple cross-site scripting (XSS) vulnerabilities in the commenting system in Review Board before 1.5.7 and 1.6.x before 1.6.3 allow remote attackers to inject arbitrary web…
–
CVSS
2.3%
EPSS
No
On KEV
Description
Multiple cross-site scripting (XSS) vulnerabilities in the commenting system in Review Board before 1.5.7 and 1.6.x before 1.6.3 allow remote attackers to inject arbitrary web script or HTML via vectors involving the (1) diff viewer or (2) screenshot component.
Exploitation
Is it being used?
Exploit prediction (EPSS)2.3% · higher than 83% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
RB
Review Board · Reviewboard
through 1.5.6; 1.0; 1.0; 1.0; 1.0; 1.0; +34 more · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2011-4312
CVE.org
https://www.cve.org/CVERecord?id=CVE-2011-4312
lists.fedoraproject.org
http://lists.fedoraproject.org/pipermail/package-announce/2011-November/070091.html
lists.fedoraproject.org
http://lists.fedoraproject.org/pipermail/package-announce/2011-November/070176.html
secunia.com
http://secunia.com/advisories/46840
www.openwall.com
http://www.openwall.com/lists/oss-security/2011/11/15/8
www.openwall.com
http://www.openwall.com/lists/oss-security/2011/11/15/9
www.reviewboard.org
http://www.reviewboard.org/docs/releasenotes/dev/reviewboard/1.6.3/
More from Review Board
9.8
CVE-2013-4409
An eval() vulnerability exists in Python Software Foundation Djblets 0.7.21 and Beanbag Review Board before 1.7.15 when parsing JSON requests
6.5
CVE-2014-5028
The Original File and Patched File resources in Review Board 1.7.x before 1.7.27 and 2.0.x before 2.0.4 allow remote authenticated users to bypass intended access restrictions and…
5.4
CVE-2021-31330
A Cross-Site Scripting (XSS) vulnerability exists within Review Board versions 3.0.20 and 4.0 RC1 and earlier
–
CVE-2014-5027
Cross-site scripting (XSS) vulnerability in Review Board 1.7.x before 1.7.27 and 2.0.x before 2.0.4 allows remote attackers to inject arbitrary web script or HTML via a query…
–
CVE-2013-4795
Cross-site scripting (XSS) vulnerability in the Submitters list in Review Board 1.6.x before 1.6.18 and 1.7.x before 1.7.12 allows remote attackers to inject arbitrary web script…