Multiple cross-site scripting (XSS) vulnerabilities in Review Board 1.6.x before 1.6.21 and 1.7.x before 1.7.17 allow remote attackers to inject arbitrary web script or HTML via the (1) Branch field or (2) caption of an uploaded file.

- Fix JavaScript errors

  - New upstream security release 1.7.17

    -       http://www.reviewboard.org/docs/releasenotes/reviewboa       rd/1.7.17/

    - Resolves: CVE-2013-4519

    - Security Fixes :

    - Fixed XSS vulnerabilities for the 'Branch' field and       uploaded file captions.

    - Added a 'X-Frame-Options' header to prevent       clickjacking.

    - New Features :

    - Remove the need for SSH keys for GitHub repositories.

    - Improved validation for GitHub repositories.

    - Added support for permissions on Local Sites.

    - Performance Improvements :

    - Reduced query counts on all pages.

    - Reduced query counts in the web API when returning       empty lists.

    - Extensibility :

    - Extensions using the ``configure_extension`` view an       now pass in a custom ``template_name`` pointing to a       template for the configuration page, if it needs       additional customization.

    - Enabling, disabling or reconfiguring extensions will       now invalidate the caches for pages, ensuring that       hooks will take affect.

    - Extension configuration now works properly on       subdirectory installs.

    - Bug Fixes :

    - Fixed showing private review requests on a submitter       page.

    - The description for submitted or discarded review       requests is now shown on the diff viewer.

    - Discarding, reopening and then closing a review       request no longer makes the review request private.

    - Fixed a naming conflict with older PyCrypto packages,       such as the default package on CentOS 6.4.

    - Users with the 'can_change_status' permission no       longer need the 'can_edit_reviewrequest' permission in       order to close or reopen review requests.

    - Switching a repository from using a hosting service to       Custom no longer reverts back to the hosting service.

    - Fixed editing a repository if its associated hosting       service can't be loaded (such as if an extension       providing that hosting service is disabled).

    - Many diff validation errors weren't being shown on the       New Review Request page, generating 500 errors       instead.

    - Fixed caching issues with the Blocks field on review       requests.

    - Editing JSON text fields in the administration UI now       works, validates, and won't result in warnings in the       log.

    - Fixed breakages with looking up URLs internally with       Local Sites.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

1.7.18 fixes JavaScript errors

  - New upstream security release 1.7.17

    -       http://www.reviewboard.org/docs/releasenotes/reviewboa       rd/1.7.17/

    - Resolves: CVE-2013-4519

    - Security Fixes :

    - Fixed XSS vulnerabilities for the 'Branch' field and       uploaded file captions.

    - Added a 'X-Frame-Options' header to prevent       clickjacking.

    - New Features :

    - Remove the need for SSH keys for GitHub repositories.

    - Improved validation for GitHub repositories.

    - Added support for permissions on Local Sites.

    - Performance Improvements :

    - Reduced query counts on all pages.

    - Reduced query counts in the web API when returning       empty lists.

    - Extensibility :

    - Extensions using the ``configure_extension`` view an       now pass in a custom ``template_name`` pointing to a       template for the configuration page, if it needs       additional customization.

    - Enabling, disabling or reconfiguring extensions will       now invalidate the caches for pages, ensuring that       hooks will take affect.

    - Extension configuration now works properly on       subdirectory installs.

    - Bug Fixes :

    - Fixed showing private review requests on a submitter       page.

    - The description for submitted or discarded review       requests is now shown on the diff viewer.

    - Discarding, reopening and then closing a review       request no longer makes the review request private.

    - Fixed a naming conflict with older PyCrypto packages,       such as the default package on CentOS 6.4.

    - Users with the 'can_change_status' permission no       longer need the 'can_edit_reviewrequest' permission in       order to close or reopen review requests.

    - Switching a repository from using a hosting service to       Custom no longer reverts back to the hosting service.

    - Fixed editing a repository if its associated hosting       service can't be loaded (such as if an extension       providing that hosting service is disabled).

    - Many diff validation errors weren't being shown on the       New Review Request page, generating 500 errors       instead.

    - Fixed caching issues with the Blocks field on review       requests.

    - Editing JSON text fields in the administration UI now       works, validates, and won't result in warnings in the       log.

    - Fixed breakages with looking up URLs internally with       Local Sites.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

- New upstream security release 1.7.17

    -       http://www.reviewboard.org/docs/releasenotes/reviewboa       rd/1.7.17/

    - Resolves: CVE-2013-4519

    - Security Fixes :

    - Fixed XSS vulnerabilities for the 'Branch' field and       uploaded file captions.

    - Added a 'X-Frame-Options' header to prevent       clickjacking.

    - New Features :

    - Remove the need for SSH keys for GitHub repositories.

    - Improved validation for GitHub repositories.

    - Added support for permissions on Local Sites.

    - Performance Improvements :

    - Reduced query counts on all pages.

    - Reduced query counts in the web API when returning       empty lists.

    - Extensibility :

    - Extensions using the ``configure_extension`` view an       now pass in a custom ``template_name`` pointing to a       template for the configuration page, if it needs       additional customization.

    - Enabling, disabling or reconfiguring extensions will       now invalidate the caches for pages, ensuring that       hooks will take affect.

    - Extension configuration now works properly on       subdirectory installs.

    - Bug Fixes :

    - Fixed showing private review requests on a submitter       page.

    - The description for submitted or discarded review       requests is now shown on the diff viewer.

    - Discarding, reopening and then closing a review       request no longer makes the review request private.

    - Fixed a naming conflict with older PyCrypto packages,       such as the default package on CentOS 6.4.

    - Users with the 'can_change_status' permission no       longer need the 'can_edit_reviewrequest' permission in       order to close or reopen review requests.

    - Switching a repository from using a hosting service to       Custom no longer reverts back to the hosting service.

    - Fixed editing a repository if its associated hosting       service can't be loaded (such as if an extension       providing that hosting service is disabled).

    - Many diff validation errors weren't being shown on the       New Review Request page, generating 500 errors       instead.

    - Fixed caching issues with the Blocks field on review       requests.

    - Editing JSON text fields in the administration UI now       works, validates, and won't result in warnings in the       log.

    - Fixed breakages with looking up URLs internally with       Local Sites.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Severity
71082	Fedora 18 : ReviewBoard-1.7.18-1.fc18 / python-djblets-0.7.23-1.fc18 (2013-20817)	Nessus	Fedora Local Security Checks	medium
70931	Fedora 19 : ReviewBoard-1.7.18-1.fc19 / python-djblets-0.7.23-1.fc19 (2013-20814)	Nessus	Fedora Local Security Checks	medium
70840	Fedora 20 : ReviewBoard-1.7.17-1.fc20 / python-djblets-0.7.23-1.fc20 (2013-20749)	Nessus	Fedora Local Security Checks	medium

Detections

Analytics

CVE-2013-4519

medium

Tenable Plugins

medium

medium

medium