CVE-2014-5027

Severity: medium (CVSS 4.3 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.3% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2014-07-25 · updated 2026-06-17
Weakness: CWE-79

Description

Cross-site scripting (XSS) vulnerability in Review Board 1.7.x before 1.7.27 and 2.0.x before 2.0.4 allows remote attackers to inject arbitrary web script or HTML via a query parameter to a diff fragment page.

Affected products

ReviewBoard Review Board: 2.0, 2.0-beta1, 2.0-beta2, 2.0-beta3, 2.0-rc1, 2.0-rc2 (+32)

References

http://seclists.org/oss-sec/2014/q3/207
http://seclists.org/oss-sec/2014/q3/219
http://secunia.com/advisories/60243
http://www.securityfocus.com/bid/68858
https://www.reviewboard.org/docs/releasenotes/reviewboard/1.7.27
https://www.reviewboard.org/docs/releasenotes/reviewboard/2.0.4
https://www.reviewboard.org/news/2014/07/22/review-board-1-7-27-and-2-0-3-security-releases
http://seclists.org/oss-sec/2014/q3/207
http://seclists.org/oss-sec/2014/q3/219
http://secunia.com/advisories/60243
http://www.securityfocus.com/bid/68858
https://www.reviewboard.org/docs/releasenotes/reviewboard/1.7.27

Get alerted when CVE-2014-5027 or the next vulnerability affects your stack