CVE-2020-5283lowCWE-80

CVE-2020-5283: low-severity vulnerability in viewvc

XSS vulnerability in CVS show_subdir_lastmod support

Published · Updated

Follow this CVE+ Monitor viewvc

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

8Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 3.1epss 1.4%
ViewVC before versions 1.1.28 and 1.2.1 has a XSS vulnerability in CVS show_subdir_lastmod support. The impact of this vulnerability is mitigated by the need for an attacker to have commit privileges to a CVS repository exposed by an otherwise trusted ViewVC instance that also has the `show_subdir_lastmod` feature enabled. The attack vector involves files with unsafe names (names that, when embedded into an HTML stream, would cause the browser to run unwanted code), which themselves can be challenging to create. This vulnerability is patched in versions 1.2.1 and 1.1.28.
CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:L/I:L/A:N
Affected products
viewvc · viewvc
Related CVEs — viewvc

In the same product, most dangerous first.

CVE-2025-54141HIGHViewVC's standalone server exposes arbitrary server filesystem contentEPSS 0.9%CVE-2023-22456MEDIUMViewVC XSS vulnerability in revision view changed pathsEPSS 0.8%CVE-2023-22464MEDIUMViewVC XSS vulnerability in revision view changed path "copyfrom" locationsEPSS 0.7%