Detections
Analytics
ViewCVS viewcvs.cgi Multiple Parameter XSS
medium Nessus Plugin ID 14823
Language:
Synopsis
A web application on the remote host has a cross-site scripting vulnerability.Description
The remote host is running ViewCVS, a tool written in Python to browse CVS repositories via the web.The version of ViewCVS running on the remote host has a cross-site scripting vulnerability. Input to the 'viewcvs' parameter is not properly sanitized. A remote attacker could exploit this by tricking a user into requesting a maliciously crafted URL, resulting in the execution of arbitrary script code.
Solution
Upgrade to the latest version of this software.See Also
Plugin Details
Severity: Medium
ID: 14823
File Name: viewcvs_xss.nasl
Version: 1.25
Type: remote
Family: CGI abuses : XSS
Published: 9/27/2004
Updated: 4/7/2022
Configuration: Enable thorough checks
Supported Sensors: Nessus
Risk Information
VPR
Risk Factor: Medium
Score: 4.8
CVSS v2
Risk Factor: Medium
Base Score: 4.3
Temporal Score: 3.7
Vector: CVSS2#AV:N/AC:M/Au:N/C:N/I:P/A:N
Vulnerability Information
CPE: cpe:/a:viewcvs:viewcvs
Excluded KB Items: Settings/disable_cgi_scanning
Exploit Ease: No exploit is required
Vulnerability Publication Date: 5/18/2002
Reference Information
CVE: CVE-2002-0771
BID: 4818