CVE-2019-13122
Vulnerability from cvelistv5
Published
2019-07-10 16:38
Modified
2024-08-04 23:41
Severity ?
EPSS score ?
Summary
A Cross Site Scripting (XSS) vulnerability exists in the template tag used to render message ids in Patchwork v1.1 through v2.1.x. This allows an attacker to insert JavaScript or HTML into the patch detail page via an email sent to a mailing list consumed by Patchwork. This affects the function msgid in templatetags/patch.py. Patchwork versions v2.1.4 and v2.0.4 will contain the fix.
References
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-04T23:41:10.501Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://github.com/getpatchwork/patchwork/releases"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://github.com/getpatchwork/patchwork/commits/master"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://lists.ozlabs.org/pipermail/patchwork/2019-July/date.html"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "http://jk.ozlabs.org/projects/patchwork/"
},
{
"name": "[oss-security] 20190705 CVE-2019-13122: Patchwork: XSS via Message-ID",
"tags": [
"mailing-list",
"x_refsource_MLIST",
"x_transferred"
],
"url": "http://www.openwall.com/lists/oss-security/2019/07/05/1"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://lists.ozlabs.org/pipermail/patchwork/2019-July/005870.html"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://lists.ozlabs.org/pipermail/patchwork/2019-July/005878.html"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "A Cross Site Scripting (XSS) vulnerability exists in the template tag used to render message ids in Patchwork v1.1 through v2.1.x. This allows an attacker to insert JavaScript or HTML into the patch detail page via an email sent to a mailing list consumed by Patchwork. This affects the function msgid in templatetags/patch.py. Patchwork versions v2.1.4 and v2.0.4 will contain the fix."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2019-07-10T16:38:51",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/getpatchwork/patchwork/releases"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/getpatchwork/patchwork/commits/master"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "https://lists.ozlabs.org/pipermail/patchwork/2019-July/date.html"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "http://jk.ozlabs.org/projects/patchwork/"
},
{
"name": "[oss-security] 20190705 CVE-2019-13122: Patchwork: XSS via Message-ID",
"tags": [
"mailing-list",
"x_refsource_MLIST"
],
"url": "http://www.openwall.com/lists/oss-security/2019/07/05/1"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "https://lists.ozlabs.org/pipermail/patchwork/2019-July/005870.html"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "https://lists.ozlabs.org/pipermail/patchwork/2019-July/005878.html"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2019-13122",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "A Cross Site Scripting (XSS) vulnerability exists in the template tag used to render message ids in Patchwork v1.1 through v2.1.x. This allows an attacker to insert JavaScript or HTML into the patch detail page via an email sent to a mailing list consumed by Patchwork. This affects the function msgid in templatetags/patch.py. Patchwork versions v2.1.4 and v2.0.4 will contain the fix."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://github.com/getpatchwork/patchwork/releases",
"refsource": "MISC",
"url": "https://github.com/getpatchwork/patchwork/releases"
},
{
"name": "https://github.com/getpatchwork/patchwork/commits/master",
"refsource": "MISC",
"url": "https://github.com/getpatchwork/patchwork/commits/master"
},
{
"name": "https://lists.ozlabs.org/pipermail/patchwork/2019-July/date.html",
"refsource": "MISC",
"url": "https://lists.ozlabs.org/pipermail/patchwork/2019-July/date.html"
},
{
"name": "http://jk.ozlabs.org/projects/patchwork/",
"refsource": "MISC",
"url": "http://jk.ozlabs.org/projects/patchwork/"
},
{
"name": "[oss-security] 20190705 CVE-2019-13122: Patchwork: XSS via Message-ID",
"refsource": "MLIST",
"url": "http://www.openwall.com/lists/oss-security/2019/07/05/1"
},
{
"name": "https://lists.ozlabs.org/pipermail/patchwork/2019-July/005870.html",
"refsource": "MISC",
"url": "https://lists.ozlabs.org/pipermail/patchwork/2019-July/005870.html"
},
{
"name": "https://lists.ozlabs.org/pipermail/patchwork/2019-July/005878.html",
"refsource": "MISC",
"url": "https://lists.ozlabs.org/pipermail/patchwork/2019-July/005878.html"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2019-13122",
"datePublished": "2019-07-10T16:38:39",
"dateReserved": "2019-07-01T00:00:00",
"dateUpdated": "2024-08-04T23:41:10.501Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1",
"meta": {
"nvd": "{\"cve\":{\"id\":\"CVE-2019-13122\",\"sourceIdentifier\":\"cve@mitre.org\",\"published\":\"2019-07-10T17:15:12.227\",\"lastModified\":\"2024-11-21T04:24:14.353\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"A Cross Site Scripting (XSS) vulnerability exists in the template tag used to render message ids in Patchwork v1.1 through v2.1.x. This allows an attacker to insert JavaScript or HTML into the patch detail page via an email sent to a mailing list consumed by Patchwork. This affects the function msgid in templatetags/patch.py. Patchwork versions v2.1.4 and v2.0.4 will contain the fix.\"},{\"lang\":\"es\",\"value\":\"Existe una vulnerabilidad de tipo Cross Site Scripting (XSS) en la etiqueta de plantilla utilizada para renderizar identificadores de mensajes en Patchwork versiones 1.1 hasta 2.1.x. Esto permite a un atacante insertar JavaScript o HTML hacia la p\u00e1gina de detalle del parche por medio de un correo electr\u00f3nico enviado hacia una lista de correo consumida por Patchwork. Esto afecta a la funci\u00f3n msgid en el archivo templatetags/patch.py. Patchwork versiones 2.1.4 y 2.0.4 contendr\u00e1n la correcci\u00f3n.\"}],\"metrics\":{\"cvssMetricV30\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.0\",\"vectorString\":\"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N\",\"baseScore\":6.1,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"REQUIRED\",\"scope\":\"CHANGED\",\"confidentialityImpact\":\"LOW\",\"integrityImpact\":\"LOW\",\"availabilityImpact\":\"NONE\"},\"exploitabilityScore\":2.8,\"impactScore\":2.7}],\"cvssMetricV2\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"2.0\",\"vectorString\":\"AV:N/AC:M/Au:N/C:N/I:P/A:N\",\"baseScore\":4.3,\"accessVector\":\"NETWORK\",\"accessComplexity\":\"MEDIUM\",\"authentication\":\"NONE\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"PARTIAL\",\"availabilityImpact\":\"NONE\"},\"baseSeverity\":\"MEDIUM\",\"exploitabilityScore\":8.6,\"impactScore\":2.9,\"acInsufInfo\":false,\"obtainAllPrivilege\":false,\"obtainUserPrivilege\":false,\"obtainOtherPrivilege\":false,\"userInteractionRequired\":true}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-79\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:ozlabs:patchwork:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"1.1\",\"versionEndExcluding\":\"2.0.4\",\"matchCriteriaId\":\"8678FB71-AAB7-4EC9-A6DF-CF84CECA0618\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:ozlabs:patchwork:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"2.1.0\",\"versionEndExcluding\":\"2.1.4\",\"matchCriteriaId\":\"1BD9CF3A-385F-4EE3-8FE3-2E18E3432A61\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:ozlabs:patchwork:2.1.0:rc1:*:*:*:*:*:*\",\"matchCriteriaId\":\"AF61E1F9-98D2-49A2-9CA9-58640EFBB7EF\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:ozlabs:patchwork:2.1.0:rc2:*:*:*:*:*:*\",\"matchCriteriaId\":\"CA6BEA6A-D49C-49D6-A8E6-1F4EDC348724\"}]}]}],\"references\":[{\"url\":\"http://jk.ozlabs.org/projects/patchwork/\",\"source\":\"cve@mitre.org\",\"tags\":[\"Vendor Advisory\"]},{\"url\":\"http://www.openwall.com/lists/oss-security/2019/07/05/1\",\"source\":\"cve@mitre.org\",\"tags\":[\"Mailing List\",\"Third Party Advisory\"]},{\"url\":\"https://github.com/getpatchwork/patchwork/commits/master\",\"source\":\"cve@mitre.org\",\"tags\":[\"Third Party Advisory\"]},{\"url\":\"https://github.com/getpatchwork/patchwork/releases\",\"source\":\"cve@mitre.org\",\"tags\":[\"Release Notes\",\"Third Party Advisory\"]},{\"url\":\"https://lists.ozlabs.org/pipermail/patchwork/2019-July/005870.html\",\"source\":\"cve@mitre.org\",\"tags\":[\"Mailing List\",\"Vendor Advisory\"]},{\"url\":\"https://lists.ozlabs.org/pipermail/patchwork/2019-July/005878.html\",\"source\":\"cve@mitre.org\",\"tags\":[\"Mailing List\",\"Vendor Advisory\"]},{\"url\":\"https://lists.ozlabs.org/pipermail/patchwork/2019-July/date.html\",\"source\":\"cve@mitre.org\",\"tags\":[\"Vendor Advisory\"]},{\"url\":\"http://jk.ozlabs.org/projects/patchwork/\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Vendor Advisory\"]},{\"url\":\"http://www.openwall.com/lists/oss-security/2019/07/05/1\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Mailing List\",\"Third Party Advisory\"]},{\"url\":\"https://github.com/getpatchwork/patchwork/commits/master\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Third Party Advisory\"]},{\"url\":\"https://github.com/getpatchwork/patchwork/releases\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Release Notes\",\"Third Party Advisory\"]},{\"url\":\"https://lists.ozlabs.org/pipermail/patchwork/2019-July/005870.html\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Mailing List\",\"Vendor Advisory\"]},{\"url\":\"https://lists.ozlabs.org/pipermail/patchwork/2019-July/005878.html\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Mailing List\",\"Vendor Advisory\"]},{\"url\":\"https://lists.ozlabs.org/pipermail/patchwork/2019-July/date.html\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Vendor Advisory\"]}]}}"
}
}
Loading…
Loading…
Sightings
| Author | Source | Type | Date |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
- Confirmed: The vulnerability is confirmed from an analyst perspective.
- Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
- Patched: This vulnerability was successfully patched by the user reporting the sighting.
- Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
- Not confirmed: The user expresses doubt about the veracity of the vulnerability.
- Not patched: This vulnerability was not successfully patched by the user reporting the sighting.