CVE-2013-2209 : Cross-site scripting (XSS) vulnerability in the auto-complete widget in htdocs/m

Cross-site scripting (XSS) vulnerability in the auto-complete widget in htdocs/media/rb/js/reviews.js in Review Board 1.6.x before 1.6.17 and 1.7.x before 1.7.10 allows remote attackers to inject arbitrary web script or HTML via a full name.

Published 2013-07-31 13:20:26

Updated 2025-04-11 00:51:22

Source Red Hat, Inc.

View at NVD, CVE.org

Vulnerability category: Cross site scripting (XSS)

Products affected by CVE-2013-2209

Reviewboard » Review Board » Version: 1.6.2
cpe:2.3:a:reviewboard:review_board:1.6.2:*:*:*:*:*:*:*
Matching versions
Reviewboard » Review Board » Version: 1.6 Update RC2
cpe:2.3:a:reviewboard:review_board:1.6:rc2:*:*:*:*:*:*
Matching versions
Reviewboard » Review Board » Version: 1.6.1
cpe:2.3:a:reviewboard:review_board:1.6.1:*:*:*:*:*:*:*
Matching versions
Reviewboard » Review Board » Version: 1.6
cpe:2.3:a:reviewboard:review_board:1.6:*:*:*:*:*:*:*
Matching versions
Reviewboard » Review Board » Version: 1.6 Update RC1
cpe:2.3:a:reviewboard:review_board:1.6:rc1:*:*:*:*:*:*
Matching versions
Reviewboard » Review Board » Version: 1.6 Update Beta2
cpe:2.3:a:reviewboard:review_board:1.6:beta2:*:*:*:*:*:*
Matching versions
Reviewboard » Review Board » Version: 1.6 Update Beta1
cpe:2.3:a:reviewboard:review_board:1.6:beta1:*:*:*:*:*:*
Matching versions
Reviewboard » Review Board » Version: 1.6.5
cpe:2.3:a:reviewboard:review_board:1.6.5:*:*:*:*:*:*:*
Matching versions
Reviewboard » Review Board » Version: 1.6.12
cpe:2.3:a:reviewboard:review_board:1.6.12:*:*:*:*:*:*:*
Matching versions
Reviewboard » Review Board » Version: 1.6.13
cpe:2.3:a:reviewboard:review_board:1.6.13:*:*:*:*:*:*:*
Matching versions
Reviewboard » Review Board » Version: 1.6.3
cpe:2.3:a:reviewboard:review_board:1.6.3:*:*:*:*:*:*:*
Matching versions
Reviewboard » Review Board » Version: 1.6.6
cpe:2.3:a:reviewboard:review_board:1.6.6:*:*:*:*:*:*:*
Matching versions
Reviewboard » Review Board » Version: 1.6.7
cpe:2.3:a:reviewboard:review_board:1.6.7:*:*:*:*:*:*:*
Matching versions
Reviewboard » Review Board » Version: 1.6.14
cpe:2.3:a:reviewboard:review_board:1.6.14:*:*:*:*:*:*:*
Matching versions
Reviewboard » Review Board » Version: 1.6.15
cpe:2.3:a:reviewboard:review_board:1.6.15:*:*:*:*:*:*:*
Matching versions
Reviewboard » Review Board » Version: 1.6.4
cpe:2.3:a:reviewboard:review_board:1.6.4:*:*:*:*:*:*:*
Matching versions
Reviewboard » Review Board » Version: 1.6.8
cpe:2.3:a:reviewboard:review_board:1.6.8:*:*:*:*:*:*:*
Matching versions
Reviewboard » Review Board » Version: 1.6.9
cpe:2.3:a:reviewboard:review_board:1.6.9:*:*:*:*:*:*:*
Matching versions
Reviewboard » Review Board » Version: 1.6.16
cpe:2.3:a:reviewboard:review_board:1.6.16:*:*:*:*:*:*:*
Matching versions
Reviewboard » Review Board » Version: 1.6.10
cpe:2.3:a:reviewboard:review_board:1.6.10:*:*:*:*:*:*:*
Matching versions
Reviewboard » Review Board » Version: 1.6.11
cpe:2.3:a:reviewboard:review_board:1.6.11:*:*:*:*:*:*:*
Matching versions
Reviewboard » Review Board » Version: 1.7.2
cpe:2.3:a:reviewboard:review_board:1.7.2:*:*:*:*:*:*:*
Matching versions
Reviewboard » Review Board » Version: 1.7.3
cpe:2.3:a:reviewboard:review_board:1.7.3:*:*:*:*:*:*:*
Matching versions
Reviewboard » Review Board » Version: 1.7.4
cpe:2.3:a:reviewboard:review_board:1.7.4:*:*:*:*:*:*:*
Matching versions
Reviewboard » Review Board » Version: 1.7.5
cpe:2.3:a:reviewboard:review_board:1.7.5:*:*:*:*:*:*:*
Matching versions
Reviewboard » Review Board » Version: 1.7.0
cpe:2.3:a:reviewboard:review_board:1.7.0:*:*:*:*:*:*:*
Matching versions
Reviewboard » Review Board » Version: 1.7.6
cpe:2.3:a:reviewboard:review_board:1.7.6:*:*:*:*:*:*:*
Matching versions
Reviewboard » Review Board » Version: 1.7.7
cpe:2.3:a:reviewboard:review_board:1.7.7:*:*:*:*:*:*:*
Matching versions
Reviewboard » Review Board » Version: 1.7.0.1
cpe:2.3:a:reviewboard:review_board:1.7.0.1:*:*:*:*:*:*:*
Matching versions
Reviewboard » Review Board » Version: 1.7.1
cpe:2.3:a:reviewboard:review_board:1.7.1:*:*:*:*:*:*:*
Matching versions
Reviewboard » Review Board » Version: 1.7.8
cpe:2.3:a:reviewboard:review_board:1.7.8:*:*:*:*:*:*:*
Matching versions
Reviewboard » Review Board » Version: 1.7.9
cpe:2.3:a:reviewboard:review_board:1.7.9:*:*:*:*:*:*:*
Matching versions

Exploit prediction scoring system (EPSS) score for CVE-2013-2209

EPSS FAQ

0.41%

Probability of exploitation activity in the next 30 days EPSS Score History

~ 58 %

Percentile, the proportion of vulnerabilities that are scored at or less

CVSS scores for CVE-2013-2209

Base Score	Base Severity	CVSS Vector	Exploitability Score	Impact Score	Score Source	First Seen
4.3	MEDIUM	AV:N/AC:M/Au:N/C:N/I:P/A:N	8.6	2.9	NIST
Access Vector: Network Access Complexity: Medium Authentication: None Confidentiality Impact: None Integrity Impact: Partial Availability Impact: None

CWE ids for CVE-2013-2209

CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Assigned by: nvd@nist.gov (Primary)

References for CVE-2013-2209

https://bugzilla.redhat.com/show_bug.cgi?id=977423

977423 – (CVE-2013-2209) CVE-2013-2209 ReviewBoard: Stored XSS due improper sanitization of user's full name in the reviews dropdown
http://www.reviewboard.org/news/2013/06/22/review-board-1617-and-1710-released/

Review Board 1.6.17 and 1.7.10 released | News | Review Board
Vendor Advisory
http://www.reviewboard.org/docs/releasenotes/reviewboard/1.6.17/

Review Board 1.6.17 Release Notes | Documentation | Review Board
http://www.openwall.com/lists/oss-security/2013/06/24/2

oss-security - Re: CVE Request -- Review Board: Stored XSS due improper sanitization of user's full name in the reviews dropdown (fixed in upstream v1.7.10, v1.6.17 versions)
http://www.tripwire.com/state-of-security/vulnerability-management/vulnerabilities-its-time-to-review-your-reviewboard

Vulnerabilities: It’s Time to Review Your ReviewBoard | The State of Security

CVEs referencing this url
https://github.com/reviewboard/reviewboard/commit/4aaacbb1e628a80803ba1a55703db38fccdf7dbf

Fix an XSS vulnerability in the reviews dropdown. · reviewboard/reviewboard@4aaacbb · GitHub
Exploit;Patch
http://www.reviewboard.org/docs/releasenotes/reviewboard/1.7.10/

Review Board 1.7.10 Release Notes | Documentation | Review Board

Jump to

Vulnerability Details : CVE-2013-2209

Products affected by CVE-2013-2209

Exploit prediction scoring system (EPSS) score for CVE-2013-2209

CVSS scores for CVE-2013-2209

CWE ids for CVE-2013-2209

References for CVE-2013-2209