CVE-2013-4795

Severity: medium (CVSS 4.3 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.4% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2014-04-11 · updated 2026-06-16
Weakness: CWE-79

Description

Cross-site scripting (XSS) vulnerability in the Submitters list in Review Board 1.6.x before 1.6.18 and 1.7.x before 1.7.12 allows remote attackers to inject arbitrary web script or HTML via a user full name.

Affected products

ReviewBoard Review Board: 1.6, 1.6-beta1, 1.6-beta2, 1.6-rc1, 1.6-rc2, 1.6.1 (+23)

References

http://osvdb.org/show/osvdb/96170
http://seclists.org/bugtraq/2013/Aug/69
http://secunia.com/advisories/54272
http://www.reviewboard.org/docs/releasenotes/reviewboard/1.6.18
http://www.reviewboard.org/docs/releasenotes/reviewboard/1.7.12
http://www.securityfocus.com/bid/61750
http://www.tripwire.com/state-of-security/vulnerability-management/vulnerabilities-its-time-to-review-your-reviewboard
https://exchange.xforce.ibmcloud.com/vulnerabilities/86410
http://osvdb.org/show/osvdb/96170
http://seclists.org/bugtraq/2013/Aug/69
http://secunia.com/advisories/54272
http://www.reviewboard.org/docs/releasenotes/reviewboard/1.6.18

Get alerted when CVE-2013-4795 or the next vulnerability affects your stack