CVE-2019-13122

    Dashboard / Vulnerabilities / CVE-2019-13122

    CVE-2019-13122

    Published: 10 Jul 2019Last Modified: 8 Jul 2026

    Summary:

    Details: A Cross Site Scripting (XSS) vulnerability exists in the template tag used to render message ids in Patchwork v1.1 through v2.1.x. This allows an attacker to insert JavaScript or HTML into the patch detail page via an email sent to a mailing list consumed by Patchwork. This affects the function msgid in templatetags/patch.py. Patchwork versions v2.1.4 and v2.0.4 will contain the fix.

    References: http://jk.ozlabs.org/projects/patchwork/, http://www.openwall.com/lists/oss-security/2019/07/05/1, https://github.com/getpatchwork/patchwork/commits/master, https://github.com/getpatchwork/patchwork/releases, https://lists.ozlabs.org/pipermail/patchwork/2019-July/005870.html, https://lists.ozlabs.org/pipermail/patchwork/2019-July/005878.html, https://lists.ozlabs.org/pipermail/patchwork/2019-July/date.html

    Affected packages

    Package

    Name:

    Purl:

    Affected ranges

    Type: GIT

    Events:

    Introduced- be6cc3c2dbb58fada64569014aa3528b7886be4f
    Fixed -6ead7215f198751b3734f725cfb82b7c7db44633

    Affected versions

    2.1.0-rc1
    2.1.0-rc2

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High