Back to Database
Status published
Medium
CVE-2013-2209
Cross-site scripting (XSS) vulnerability in the auto-complete widget in htdocs/media/rb/js/reviews.js...
Vulnerability Description
Cross-site scripting (XSS) vulnerability in the auto-complete widget in htdocs/media/rb/js/reviews.js in Review Board 1.6.x before 1.6.17 and 1.7.x before 1.7.10 allows remote attackers to inject arbitrary web script or HTML via a full name.
Impact Analysis
Refer to official advisory for detailed impact metrics.
Remediation
Ensure systems are updated to the latest vendor-supplied patch levels.
THREAT MONITOR
Am I Vulnerable?
Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2013-2209
Credits & Attribution
No credits recorded in the NVD database.
References
- http://www.tripwire.com/state-of-security/vulnerability-management/vulnerabilities-its-time-to-review-your-reviewboard
- https://bugzilla.redhat.com/show_bug.cgi?id=977423
- http://www.reviewboard.org/news/2013/06/22/review-board-1617-and-1710-released/
- http://www.openwall.com/lists/oss-security/2013/06/24/2
- https://github.com/reviewboard/reviewboard/commit/4aaacbb1e628a80803ba1a55703db38fccdf7dbf
- http://www.reviewboard.org/docs/releasenotes/reviewboard/1.6.17/
- http://www.reviewboard.org/docs/releasenotes/reviewboard/1.7.10/
More from reviewboard
View All →CVE-2021-31330
A Cross-Site Scripting (XSS) vulnerability exists within Review Board versions...
Medium
5.4
CVE-2014-5028
The Original File and Patched File resources in Review Board...
Medium
6.5
CVE-2014-5027
Cross-site scripting (XSS) vulnerability in Review Board 1.7.x before 1.7.27...
Medium
4.3
CVE-2014-3995
Cross-site scripting (XSS) vulnerability in gravatars/templatetags/gravatars.py in Djblets before 0.7.30...
Medium
4.3
CVE-2014-3994
Cross-site scripting (XSS) vulnerability in util/templatetags/djblets_js.py in Djblets before 0.7.30...
Medium
4.3
Affected Vendor
reviewboard
View all reports →Affected Software
review board
Vulnerable Versions:
1.6, 1.6.1, 1.6.2, 1.6.3, 1.6.4, 1.6.5, 1.6.6, 1.6.7, 1.6.8, 1.6.9, 1.6.10, 1.6.11, 1.6.12, 1.6.13, 1.6.14, 1.6.15, 1.6.16, 1.7.0, 1.7.0.1, 1.7.1, 1.7.2, 1.7.3, 1.7.4, 1.7.5, 1.7.6, 1.7.7, 1.7.8, 1.7.9
Timeline
Official Publish:
July 31st, 2013
Last Modified:
August 6th, 2024
Added to House:
July 19th, 2026
CVSS Vectors
Weaknesses (CWE)
No CWE data available
MITRE ATT&CK TTPs
No associated TTPs found for this vulnerability.