Unscored severity · published Nov 19, 2013
CVE-2013-4519
Multiple cross-site scripting (XSS) vulnerabilities in Review Board 1.6.x before 1.6.21 and 1.7.x before 1.7.17 allow remote attackers to inject arbitrary web script or HTML via…
–
CVSS
2%
EPSS
No
On KEV
Description
Multiple cross-site scripting (XSS) vulnerabilities in Review Board 1.6.x before 1.6.21 and 1.7.x before 1.7.17 allow remote attackers to inject arbitrary web script or HTML via the (1) Branch field or (2) caption of an uploaded file.
Exploitation
Is it being used?
Exploit prediction (EPSS)2.0% · higher than 81% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
RB
Review Board · Reviewboard
1.6; 1.6; 1.6; 1.6; 1.6; 1.6.1; +34 more · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2013-4519
CVE.org
https://www.cve.org/CVERecord?id=CVE-2013-4519
osvdb.org
http://osvdb.org/99512
osvdb.org
http://osvdb.org/99513
Vendor Advisory
http://secunia.com/advisories/55623
Vendor Advisory
http://www.reviewboard.org/docs/releasenotes/reviewboard/1.6.21
Vendor Advisory
http://www.reviewboard.org/docs/releasenotes/reviewboard/1.7.17
www.securityfocus.com
http://www.securityfocus.com/bid/63601
More from Review Board
9.8
CVE-2013-4409
An eval() vulnerability exists in Python Software Foundation Djblets 0.7.21 and Beanbag Review Board before 1.7.15 when parsing JSON requests
6.5
CVE-2014-5028
The Original File and Patched File resources in Review Board 1.7.x before 1.7.27 and 2.0.x before 2.0.4 allow remote authenticated users to bypass intended access restrictions and…
5.4
CVE-2021-31330
A Cross-Site Scripting (XSS) vulnerability exists within Review Board versions 3.0.20 and 4.0 RC1 and earlier
–
CVE-2014-5027
Cross-site scripting (XSS) vulnerability in Review Board 1.7.x before 1.7.27 and 2.0.x before 2.0.4 allows remote attackers to inject arbitrary web script or HTML via a query…
–
CVE-2013-4795
Cross-site scripting (XSS) vulnerability in the Submitters list in Review Board 1.6.x before 1.6.18 and 1.7.x before 1.7.12 allows remote attackers to inject arbitrary web script…