ALPINE-CVE-2019-13122

    Dashboard / Vulnerabilities / ALPINE-CVE-2019-13122

    ALPINE-CVE-2019-13122

    Published: 10 Jul 2019Last Modified: 10 Sept 2026
    Upstream:
    CVE-2019-13122

    Summary:

    Details: A Cross Site Scripting (XSS) vulnerability exists in the template tag used to render message ids in Patchwork v1.1 through v2.1.x. This allows an attacker to insert JavaScript or HTML into the patch detail page via an email sent to a mailing list consumed by Patchwork. This affects the function msgid in templatetags/patch.py. Patchwork versions v2.1.4 and v2.0.4 will contain the fix.

    References: https://security.alpinelinux.org/vuln/CVE-2019-13122

    Affected packages

    Package

    Name: patchwork

    Purl: pkg:apk/alpine/patchwork?arch=source

    Affected ranges

    Type: ECOSYSTEM

    Events:

    Introduced- 1.1
    Fixed -1.1.3-r1

    Affected versions

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High