CVE-2020-5283 : ViewVC before versions 1.1.28 and 1.2.1 has a XSS vulnerability in CVS show_subdir

ViewVC before versions 1.1.28 and 1.2.1 has a XSS vulnerability in CVS show_subdir_lastmod support. The impact of this vulnerability is mitigated by the need for an attacker to have commit privileges to a CVS repository exposed by an otherwise trusted ViewVC instance that also has the `show_subdir_lastmod` feature enabled. The attack vector involves files with unsafe names (names that, when embedded into an HTML stream, would cause the browser to run unwanted code), which themselves can be challenging to create. This vulnerability is patched in versions 1.2.1 and 1.1.28.

Published 2020-04-03 00:15:12

Updated 2020-05-15 06:15:11

Source GitHub, Inc.

View at NVD, CVE.org

Vulnerability category: Cross site scripting (XSS)

Exploit prediction scoring system (EPSS) score for CVE-2020-5283

EPSS FAQ

0.13%

Probability of exploitation activity in the next 30 days EPSS Score History

~ 46 %

Percentile, the proportion of vulnerabilities that are scored at or less

CVSS scores for CVE-2020-5283

Base Score	Base Severity	CVSS Vector	Exploitability Score	Impact Score	Score Source
2.1	LOW	AV:N/AC:H/Au:S/C:N/I:P/A:N	3.9	2.9	NIST
Access Vector: Network Access Complexity: High Authentication: Single Confidentiality Impact: None Integrity Impact: Partial Availability Impact: None
3.5	LOW	CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:L/I:L/A:N	0.9	2.5	NIST
Attack Vector: Network Attack Complexity: Low Privileges Required: High User Interaction: Required Scope: Unchanged Confidentiality: Low Integrity: Low Availability: None
3.1	LOW	CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:L/I:L/A:N	0.5	2.5	GitHub, Inc.
Attack Vector: Network Attack Complexity: High Privileges Required: High User Interaction: Required Scope: Unchanged Confidentiality: Low Integrity: Low Availability: None

CWE ids for CVE-2020-5283

CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Assigned by: nvd@nist.gov (Primary)

CWE-80 Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)

The product receives input from an upstream component, but it does not neutralize or incorrectly neutralizes special characters such as "<", ">", and "&" that could be interpreted as web-scripting elements when they are sent to a downstream component that processes web pages.

Assigned by: security-advisories@github.com (Secondary)

References for CVE-2020-5283

https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/2Q2STF2MKT24HXZ3YZIU7CN6F6QM67I5/

[SECURITY] Fedora 30 Update: viewvc-1.1.28-1.fc30 - package-announce - Fedora Mailing-Lists
https://github.com/viewvc/viewvc/issues/211

XSS vulnerability: CVS lastlog filename not escaped · Issue #211 · viewvc/viewvc · GitHub
Exploit;Issue Tracking;Third Party Advisory
https://github.com/viewvc/viewvc/security/advisories/GHSA-xpxf-fvqv-7mfg

XSS vulnerability in CVS show_subdir_lastmod support · Advisory · viewvc/viewvc · GitHub
Mitigation;Patch;Third Party Advisory
https://github.com/viewvc/viewvc/commit/ad0f966e9a997b17d853a6972ea283d4dcd70fa8

issue #211: escape CVS subdir last-modified file name · viewvc/viewvc@ad0f966 · GitHub
Patch;Third Party Advisory

Products affected by CVE-2020-5283

Viewvc » Viewvc
Versions from including (>=) 1.2.0 and before (<) 1.2.1
cpe:2.3:a:viewvc:viewvc:*:*:*:*:*:*:*:*
Matching versions
Viewvc » Viewvc
Versions before (<) 1.1.28
cpe:2.3:a:viewvc:viewvc:*:*:*:*:*:*:*:*
Matching versions

Vulnerability Details : CVE-2020-5283

Exploit prediction scoring system (EPSS) score for CVE-2020-5283

CVSS scores for CVE-2020-5283

CWE ids for CVE-2020-5283

References for CVE-2020-5283

Products affected by CVE-2020-5283