Full changelog:
http://viewvc.tigris.org/source/browse/viewvc/trunk/CHANGES?r evision=2359&view=markup&pathrev=HEAD - security fix: escape user-provided search_re input to avoid XSS attack

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The regular expression search feature didn't properly sanitize user input, therefore allowing attackers to conduct cross-site-scripting (XSS) attacks (CVE-2010-0132).

CVS support got broken by the previous viewvc update for CVE-2010-0132. This release fixes that again.

The remote web server is hosting a version of ViewVC that is affected by a cross-site scripting vulnerability in the 'search' parameter of the 'viewvc.cgi' script.

An attacker, exploiting this flaw, could execute arbitrary script code in a user's browser.

Note that successful exploitation requires the regular expression search functionality to be enabled.  It is not by default.

The remote web server is running ViewVC, a web-based interface for CVS and Subversion.  The installed version of ViewVC is earlier than 1.0.11 or 1.1.5.  Such versions are potentially affected by a cross-site scripting vulnerability because the application fails to properly sanitize user supplied data to the regular expression search feature.

ID	Name	Product	Family	Published	Updated	Severity
47406	Fedora 13 : viewvc-1.1.5-1.fc13 (2010-5805)	Nessus	Fedora Local Security Checks	7/1/2010	1/11/2021	low
45464	openSUSE Security Update : viewvc (viewvc-2240)	Nessus	SuSE Local Security Checks	4/9/2010	1/14/2021	low
45470	openSUSE Security Update : viewvc (viewvc-2240)	Nessus	SuSE Local Security Checks	4/9/2010	1/14/2021	low
47396	Fedora 12 : viewvc-1.1.5-1.fc12 (2010-5524)	Nessus	Fedora Local Security Checks	7/1/2010	1/11/2021	low
45481	openSUSE Security Update : viewvc (openSUSE-SU-2010:0098-1)	Nessus	SuSE Local Security Checks	4/12/2010	1/14/2021	low
45482	openSUSE Security Update : viewvc (openSUSE-SU-2010:0098-1)	Nessus	SuSE Local Security Checks	4/12/2010	1/14/2021	low
45406	ViewVC viewvc.cgi search Parameter XSS	Nessus	CGI abuses : XSS	4/2/2010	4/11/2022	low
47392	Fedora 11 : viewvc-1.1.5-1.fc11 (2010-5507)	Nessus	Fedora Local Security Checks	7/1/2010	1/11/2021	low
45458	openSUSE Security Update : viewvc (viewvc-2240)	Nessus	SuSE Local Security Checks	4/9/2010	1/14/2021	low
5501	ViewVC < 1.0.11 / 1.1.5 Regex Search Cross-Site Scripting Vulnerability	Nessus Network Monitor	CGI	4/2/2010	3/6/2019	medium

Detections

Analytics

Plugins Search

low

low

low

low

low

low

low

low

low

medium