CVE-2017-5938
Fixed in a distro release EPSS 1%
Cross-site scripting (XSS) vulnerability in the nav_path function in lib/viewvc.py in ViewVC before 1.0.14 and 1.1.x before 1.1.26 allows remote attackers to inject arbitrary web script or HTML via the nav_data name.
Products: debian_linux, opensuse leap, opensuse_project leap, viewvc
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Debian 7 | viewvc | 1.1.5-1.4+deb7u1 |
| Debian 8 | viewvc | 1.1.22-1+deb8u1 |
| Ubuntu 14.04 LTS | viewvc | 1.1.5-1.4+deb7u1build0.14.04.1 |
| Ubuntu 16.04 LTS | viewvc | 1.1.22-1+deb8u1build0.16.04.1 |
| openSUSE Tumbleweed | viewvc | 1.3.0~dev20230104-1.1 |