CVE-2014-3994

2014-06-1618:55:09

CWE-79

[email protected]

web.nvd.nist.gov

CVSS2

4.3

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:N/C:N/I:P/A:N

AI Score

5.5

Confidence

High

EPSS

0.002

Percentile

61.0%

JSON

Cross-site scripting (XSS) vulnerability in util/templatetags/djblets_js.py in Djblets before 0.7.30 and 0.8.x before 0.8.3 for Django, as used in Review Board, allows remote attackers to inject arbitrary web script or HTML via a JSON object, as demonstrated by the name field when changing a user name.

Affected configurations

Nvd

Node

reviewboarddjbletsRange≤0.7.29

reviewboarddjbletsMatch0.7.27

reviewboarddjbletsMatch0.7.28

reviewboarddjbletsMatch0.8.1

reviewboarddjbletsMatch0.8.2

reviewboardreviewboardMatch-

VendorProductVersionCPE
reviewboarddjblets*cpe:2.3:a:reviewboard:djblets:*:*:*:*:*:*:*:*
reviewboarddjblets0.7.27cpe:2.3:a:reviewboard:djblets:0.7.27:*:*:*:*:*:*:*
reviewboarddjblets0.7.28cpe:2.3:a:reviewboard:djblets:0.7.28:*:*:*:*:*:*:*
reviewboarddjblets0.8.1cpe:2.3:a:reviewboard:djblets:0.8.1:*:*:*:*:*:*:*
reviewboarddjblets0.8.2cpe:2.3:a:reviewboard:djblets:0.8.2:*:*:*:*:*:*:*
reviewboardreviewboard-cpe:2.3:a:reviewboard:reviewboard:-:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
reviewboard	djblets	*	cpe:2.3:a:reviewboard:djblets::::::::
reviewboard	djblets	0.7.27	cpe:2.3:a:reviewboard:djblets:0.7.27:::::::*
reviewboard	djblets	0.7.28	cpe:2.3:a:reviewboard:djblets:0.7.28:::::::*
reviewboard	djblets	0.8.1	cpe:2.3:a:reviewboard:djblets:0.8.1:::::::*
reviewboard	djblets	0.8.2	cpe:2.3:a:reviewboard:djblets:0.8.2:::::::*
reviewboard	reviewboard	-	cpe:2.3:a:reviewboard:reviewboard:-:::::::*