CVE-2012-4533

Severity: medium (CVSS 4.3 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 3.1% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2012-11-19 · updated 2026-06-16
Weakness: CWE-79

Description

Cross-site scripting (XSS) vulnerability in the "extra" details in the DiffSource._get_row function in lib/viewvc.py in ViewVC 1.0.x before 1.0.13 and 1.1.x before 1.1.16 allows remote authenticated users with repository commit access to inject arbitrary web script or HTML via the "function name" line.

Affected products

Debian Linux: 6.0, 7.0
viewvc: from 1.0.0 before 1.0.13; from 1.1.0 before 1.1.16 — fixed in 1.0.13, 1.1.16

How to fix

Upgrade to a fixed version: viewvc 1.0.13, 1.1.16. Check the vendor advisory for mitigations.

References

http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=691062
http://osvdb.org/86566
http://secunia.com/advisories/51041
http://secunia.com/advisories/51072
http://viewvc.tigris.org/issues/show_bug.cgi?id=515
http://viewvc.tigris.org/source/browse/%2Acheckout%2A/viewvc/tags/1.0.13/CHANGES
http://viewvc.tigris.org/source/browse/%2Acheckout%2A/viewvc/tags/1.1.16/CHANGES
http://viewvc.tigris.org/source/browse/viewvc?view=rev&revision=2792
http://viewvc.tigris.org/source/browse/viewvc?view=rev&revision=2794
http://www.debian.org/security/2012/dsa-2563
http://www.mandriva.com/security/advisories?name=MDVSA-2013:134
http://www.openwall.com/lists/oss-security/2012/10/21/2

Get alerted when CVE-2012-4533 or the next vulnerability affects your stack