Cross-site scripting (XSS) vulnerability in the waterfall web status view (status/web/waterfall.py) in Buildbot 0.7.6 through 0.7.11p1 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.

The version of BuildBot WebStatus running on the remote host has a cross-site scripting vulnerability.  Input to the 'branch' parameter of the '/waterfall/help' page is not properly sanitized.  A remote attacker could exploit this by tricking a user into requesting a malicious URL, which could result in the execution of arbitrary script code.

This version of BuildBot has several other cross-site scripting vulnerabilities, though Nessus has not checked for those issues.

The remote host is running Buildbot, a software project to automate the compile test cycle for software projects.  The installed version is earlier than 0.7.11p3.  Such versions are potentially affected by multiple cross-site scripting vulnerabilities.

Update to new upstream version 0.7.11p3:
http://pypi.python.org/pypi/buildbot/0.7.11p3 fixing XSS issue detailed in upstream security alert:
http://buildbot.net/trac#SecurityAlert

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Severity
42346	BuildBot WebStatus waterfall 'branch' Parameter XSS	Nessus	CGI abuses : XSS	medium
5138	Buildbot < 0.7.11p3 Multiple Cross-site Scripting Vulnerabilities	Nessus Network Monitor	CGI	medium
40672	Fedora 10 : buildbot-0.7.11p3-1.fc10 (2009-8577)	Nessus	Fedora Local Security Checks	medium
40671	Fedora 11 : buildbot-0.7.11p3-2.fc11 (2009-8516)	Nessus	Fedora Local Security Checks	medium

Detections

Analytics

CVE-2009-2959

medium

Tenable Plugins

medium

medium

medium

medium