CVE Feed

    Dashboard / CVE / CVE-2014-3994

    CVE-2014-3994

    Cross-site scripting (XSS) vulnerability in util/templatetags/djblets_js.py in Djblets before 0.7.30 and 0.8.x before 0.8.3 for Django, as used in Review Board, allows remote attackers to inject arbitrary web script or HTML via a JSON object, as demonstrated by the name field when changing a user name.

    Published:Jun 16, 2014
    Last Modified:Apr 12, 2025
    EPS:Jun 16, 2014
    EPSS Score:0.00588
    CVSS Score:4.3

    Affected Products

    Vendor
    Reviewboard
    Product
    Djblets
    Vendor
    Reviewboard
    Product
    Reviewboard

    Exploits

    https://github.com/djblets/djblets/commit/77a68c03cd619a0996f3f37337b8c39ca6643d6ehttps://github.com/djblets/djblets/commit/77a68c03cd619a0996f3f37337b8c39ca6643d6e

    References

    http://seclists.org/oss-sec/2014/q2/494
    http://seclists.org/oss-sec/2014/q2/498
    http://secunia.com/advisories/58691
    http://www.securityfocus.com/bid/67932
    https://code.google.com/p/reviewboard/issues/detail?id=3406
    https://github.com/djblets/djblets/commit/50000d0bbb983fa8c097b588d06b64df8df483bd
    https://github.com/djblets/djblets/commit/77a68c03cd619a0996f3f37337b8c39ca6643d6e
    https://github.com/djblets/djblets/commit/e2c79117efd925636acd871a5f473512602243cf
    http://seclists.org/oss-sec/2014/q2/494
    http://seclists.org/oss-sec/2014/q2/498
    http://secunia.com/advisories/58691
    http://www.securityfocus.com/bid/67932
    https://code.google.com/p/reviewboard/issues/detail?id=3406
    https://github.com/djblets/djblets/commit/50000d0bbb983fa8c097b588d06b64df8df483bd
    https://github.com/djblets/djblets/commit/77a68c03cd619a0996f3f37337b8c39ca6643d6e
    https://github.com/djblets/djblets/commit/e2c79117efd925636acd871a5f473512602243cf

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High