Cross-site scripting (XSS) vulnerability in WebSVN 2.3.3 and earlier allows remote attackers to inject arbitrary web script or HTML via the path parameter to log.php.

- Fix CVE-2016-2511

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Sebastien Delafond reports :

Jakub Palaczynski discovered that websvn, a web viewer for Subversion repositories, does not correctly sanitize user-supplied input, which allows a remote user to run reflected cross-site scripting attacks.

Jakub Palaczynski discovered that websvn, a web viewer for Subversion repositories, does not correctly sanitize user-supplied input, which allows a remote user to run reflected cross-site scripting attacks.

It was discovered that there was a cross-site scripting vulnerability in websvn, a web-based Subversion repository browser

For Debian 6 Squeeze, this issue has been fixed in websvn version 2.3.1-1+deb6u2.

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Severity
90040	Fedora 23 : websvn-2.3.3-12.fc23 (2016-657a1305aa)	Nessus	Fedora Local Security Checks	medium
90034	Fedora 22 : websvn-2.3.3-12.fc22 (2016-11537160e9)	Nessus	Fedora Local Security Checks	medium
89707	FreeBSD : websvn -- reflected XSS (12d1b5a6-e39d-11e5-9f77-5453ed2e2b49)	Nessus	FreeBSD Local Security Checks	medium
88942	Debian DSA-3490-1 : websvn - security update	Nessus	Debian Local Security Checks	medium
88939	Debian DLA-428-1 : websvn security update	Nessus	Debian Local Security Checks	medium

Detections

Analytics

CVE-2016-2511

medium

Tenable Plugins

medium

medium

medium

medium

medium