Multiple cross-site scripting (XSS) vulnerabilities in ViewCVS 0.9.2 allow remote attackers to inject arbitrary HTML and web script via certain error messages.

The remote host is running ViewCVS, a tool to browse CVS repositories over the web. There is a flaw in the remote ViewCVS server that may allow an attacker to steal the credentials of third-party users via an HTTP response splitting attack.

The remote host is affected by the vulnerability described in GLSA-200412-26 (ViewCVS: Information leak and XSS vulnerabilities)

    The tar export functions in ViewCVS bypass the 'hide_cvsroot' and     'forbidden' settings and therefore expose information that should be     kept secret (CAN-2004-0915). Furthermore, some error messages in     ViewCVS do not filter user-provided information, making it vulnerable     to a cross-site scripting attack (CAN-2004-1062).
  Impact :

    By using the tar export functions, a remote attacker could access     information that is configured as restricted. Through the use of a     malicious request, an attacker could also inject and execute malicious     script code, potentially compromising another user's browser.
  Workaround :

    There is no known workaround at this time.

The remote host is running ViewCVS, a tool to browse CVS repositories over the web written in python. 

Flaws in the remote version of this website may allow an attacker to launch cross-site scripting and/or HTTP response-splitting attacks against the remote install.

The remote host is using the ViewCVS, a tool to browse CVS repositories.
According to its version number, the remote version of this software is vulnerable to multiple unspecified vulnerabilities.

ID	Name	Product	Family	Severity
2478	ViewCVS < 1.0.0 HTTP Response Splitting	Nessus Network Monitor	CGI	high
16068	GLSA-200412-26 : ViewCVS: Information leak and XSS vulnerabilities	Nessus	Gentoo Local Security Checks	medium
16062	ViewCVS < 1.0.0 Multiple Vulnerabilities	Nessus	CGI abuses	medium
2446	ViewCVS < 1.0-dev Multiple Unspecified Vulnerabilities	Nessus Network Monitor	CGI	high

Detections

Analytics

CVE-2004-1062

medium

Tenable Plugins

high

medium

medium

high