Multiple cross-site scripting (XSS) vulnerabilities in (1) revision.php, (2) log.php, (3) listing.php, and (4) comp.php in WebSVN allow context-dependent attackers to inject arbitrary web script or HTML via the name of a (a) file or (b) directory in a repository.

Fix for CVE-2016-1236.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Nitin Venkatesh discovered that websvn, a web viewer for Subversion repositories, is susceptible to cross-site scripting attacks via specially crafted file and directory names in repositories.

Nitin Venkatesh discovered that websvn, a web viewer for Subversion repositories, is susceptible to cross-site scripting attacks via specially crafted file and directory names in repositories.

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Severity
92161	Fedora 22 : websvn (2016-cafcf15357)	Nessus	Fedora Local Security Checks	medium
92143	Fedora 24 : websvn (2016-b0419504f4)	Nessus	Fedora Local Security Checks	medium
92057	Fedora 23 : websvn (2016-0cb7475aa6)	Nessus	Fedora Local Security Checks	medium
91024	Debian DSA-3572-1 : websvn - security update	Nessus	Debian Local Security Checks	medium
91021	Debian DLA-462-1 : websvn security update	Nessus	Debian Local Security Checks	medium

Detections

Analytics

CVE-2016-1236

medium

Tenable Plugins

medium

medium

medium

medium

medium