Description
Cross-site scripting (XSS) vulnerability in the "extra" details in the DiffSource._get_row function in lib/viewvc.py in ViewVC 1.0.x before 1.0.13 and 1.1.x before 1.1.16 allows remote authenticated users with repository commit access to inject arbitrary web script or HTML via the "function name" line.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 6.0 | viewvc | 1.1.5-1.1+squeeze2 | DSA-2563-1 |
Advisories 1
- DSA-2563-1 viewvc - several Debian Security (DSA / DLA) · Mar 9, 2026
References
- http://viewvc.tigris.org/issues/show_bug.cgi?id=515
- 86566 vdb-entry
- http://viewvc.tigris.org/source/browse/viewvc?view=rev&revision=2794
- 51041 third-party-advisory
- http://viewvc.tigris.org/source/browse/viewvc?view=rev&revision=2792
- 56161 vdb-entry
- viewvc-viewvc-checkins-xss(79561) vdb-entry
- http://viewvc.tigris.org/source/browse/%2Acheckout%2A/viewvc/tags/1.0.13/CHANGES
- http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=691062
- [oss-security] 20121020 Re: CVE Request: viewvc 1.1.5 lib/viewvc.py XSS mailing-list
- https://wiki.mageia.org/en/Support/Advisories/MGASA-2012-0313
- MDVSA-2013:134 vendor-advisory
- DSA-2563 vendor-advisory
- [oss-security] 20121020 CVE Request: viewvc 1.1.5 lib/viewvc.py XSS mailing-list
- http://viewvc.tigris.org/source/browse/%2Acheckout%2A/viewvc/tags/1.1.16/CHANGES
- 51072 third-party-advisory