CVE-2010-0132: XSS
Published Mar 31, 2010
·Updated
Cross-site scripting (XSS) vulnerability in ViewVC 1.1 before 1.1.5 and 1.0 before 1.0.11, when the regular expression search functionality is enabled, allows remote attackers to inject arbitrary web script or HTML via vectors related to "searchre input," a different vulnerability than CVE-2010-0736.
Affected Software
16 affected components
viewvc ViewVC=1.0.2
viewvc ViewVC=1.0.1
viewvc ViewVC=1.0.5
viewvc ViewVC=1.1.2
viewvc ViewVC=1.0.9
viewvc ViewVC=1.1.0
viewvc ViewVC=1.1.1
viewvc ViewVC=1.1.4
viewvc ViewVC=1.0.3
viewvc ViewVC=1.0.4
viewvc ViewVC=1.0.6
viewvc ViewVC=1.0.8
viewvc ViewVC=1.0.10
viewvc ViewVC=1.0.0
viewvc ViewVC=1.0.7
viewvc ViewVC=1.1.3
Remediation
Patch Available
Event History
Mar 31, 2010
CVE Published
via MITRE·05:35 PM
Data Sourced
via MITRE·05:35 PM
Description
Data Sourced
via NVD·06:00 PM
RemedyDescriptionSeverityWeaknessAffected Software
Frequently Asked Questions
1
What is the severity of CVE-2010-0132?
CVE-2010-0132 is classified as a medium-severity cross-site scripting vulnerability.
2
How do I fix CVE-2010-0132?
To fix CVE-2010-0132, upgrade ViewVC to version 1.1.5 or 1.0.11 or later.
3
What versions of ViewVC are affected by CVE-2010-0132?
CVE-2010-0132 affects ViewVC versions 1.0.0 to 1.0.10 and versions 1.1.0 to 1.1.4.
4
What type of vulnerability is CVE-2010-0132?
CVE-2010-0132 is a cross-site scripting (XSS) vulnerability.
5
Can CVE-2010-0132 be exploited remotely?
Yes, CVE-2010-0132 can be exploited remotely by attackers through the attacked application.