CVE-2003-0154

23Vexday Risk Score

No sign of exploitation. It has a public proof of concept.

ssvc Attendepss 4.6%

from disclosure to weapon0 days

Published on NVDMar 26

1st PoCAug 20

exploitation probability

4.6%top 9% of all CVEs

observed exploitation

nono source reports it

1 public exploit(s)

Cross-site scripting vulnerabilities (XSS) in bonsai Mozilla CVS query tool allow remote attackers to execute arbitrary web script via (1) the file, root, or rev parameters to cvslog.cgi, (2) the file or root parameters to cvsblame.cgi, (3) various parameters to cvsquery.cgi, (4) the person parameter to showcheckins.cgi, (5) the module parameter to cvsqueryform.cgi, and (6) possibly other attack vectors as identified by Mozilla bug #146244.

Affected products

n/a · n/a

public PoCs found — 1✓ VexDay Proof

exploitdb✓ VexDay Proofwww.exploit-db.com/exploits/21729

⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.

References

http://bugzilla.mozilla.org/attachment.cgi?id=95950&action=view http://bugzilla.mozilla.org/attachment.cgi?id=95985&action=view http://bugzilla.mozilla.org/show_bug.cgi?id=146244 http://bugzilla.mozilla.org/show_bug.cgi?id=163573 http://marc.info/?l=bugtraq&m=102980129101054&w=2 http://www.debian.org/security/2003/dsa-265 http://www.iss.net/security_center/static/9920.php http://www.securityfocus.com/bid/5516