« Volver al listado

CVE-2019-13122

Estado: ModificadaMedia (6.1)—

A Cross Site Scripting (XSS) vulnerability exists in the template tag used to render message ids in Patchwork v1.1 through v2.1.x. This allows an attacker to insert JavaScript or HTML into the patch detail page via an email sent to a mailing list consumed by Patchwork. This affects the function msgid in templatetags/patch.py. Patchwork versions v2.1.4 and v2.0.4 will contain the fix.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

Ozlabs — Patchwork

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2019-13122",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 4.3,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N",
          "authentication": "NONE",
          "integrityImpact": "PARTIAL",
          "accessComplexity": "MEDIUM",
          "availabilityImpact": "NONE",
          "confidentialityImpact": "NONE"
        },
        "acInsufInfo": false,
        "impactScore": 2.9,
        "baseSeverity": "MEDIUM",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 8.6,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": true
      }
    ],
    "cvssMetricV30": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "CHANGED",
          "version": "3.0",
          "baseScore": 6.1,
          "attackVector": "NETWORK",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
          "integrityImpact": "LOW",
          "userInteraction": "REQUIRED",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "LOW"
        },
        "impactScore": 2.7,
        "exploitabilityScore": 2.8
      }
    ]
  },
  "affected": [
    {
      "source": "cve@mitre.org",
      "affectedData": [
        {
          "vendor": "n/a",
          "product": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ]
    }
  ],
  "published": "2019-07-10T17:15:12.227",
  "references": [
    {
      "url": "http://jk.ozlabs.org/projects/patchwork/",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "cve@mitre.org"
    },
    {
      "url": "http://www.openwall.com/lists/oss-security/2019/07/05/1",
      "tags": [
        "Mailing List",
        "Third Party Advisory"
      ],
      "source": "cve@mitre.org"
    },
    {
      "url": "https://github.com/getpatchwork/patchwork/commits/master",
      "tags": [
        "Third Party Advisory"
      ],
      "source": "cve@mitre.org"
    },
    {
      "url": "https://github.com/getpatchwork/patchwork/releases",
      "tags": [
        "Release Notes",
        "Third Party Advisory"
      ],
      "source": "cve@mitre.org"
    },
    {
      "url": "https://lists.ozlabs.org/pipermail/patchwork/2019-July/005870.html",
      "tags": [
        "Mailing List",
        "Vendor Advisory"
      ],
      "source": "cve@mitre.org"
    },
    {
      "url": "https://lists.ozlabs.org/pipermail/patchwork/2019-July/005878.html",
      "tags": [
        "Mailing List",
        "Vendor Advisory"
      ],
      "source": "cve@mitre.org"
    },
    {
      "url": "https://lists.ozlabs.org/pipermail/patchwork/2019-July/date.html",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "cve@mitre.org"
    },
    {
      "url": "http://jk.ozlabs.org/projects/patchwork/",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.openwall.com/lists/oss-security/2019/07/05/1",
      "tags": [
        "Mailing List",
        "Third Party Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://github.com/getpatchwork/patchwork/commits/master",
      "tags": [
        "Third Party Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://github.com/getpatchwork/patchwork/releases",
      "tags": [
        "Release Notes",
        "Third Party Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://lists.ozlabs.org/pipermail/patchwork/2019-July/005870.html",
      "tags": [
        "Mailing List",
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://lists.ozlabs.org/pipermail/patchwork/2019-July/005878.html",
      "tags": [
        "Mailing List",
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://lists.ozlabs.org/pipermail/patchwork/2019-July/date.html",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-79"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "A Cross Site Scripting (XSS) vulnerability exists in the template tag used to render message ids in Patchwork v1.1 through v2.1.x. This allows an attacker to insert JavaScript or HTML into the patch detail page via an email sent to a mailing list consumed by Patchwork. This affects the function msgid in templatetags/patch.py. Patchwork versions v2.1.4 and v2.0.4 will contain the fix."
    },
    {
      "lang": "es",
      "value": "Existe  una vulnerabilidad de tipo Cross Site Scripting (XSS) en la etiqueta de plantilla utilizada para renderizar identificadores de mensajes en Patchwork versiones 1.1 hasta 2.1.x. Esto permite a un atacante insertar JavaScript o HTML hacia la página de detalle del parche por medio de un correo electrónico enviado hacia una lista de correo consumida por Patchwork. Esto afecta a la función msgid en el archivo templatetags/patch.py. Patchwork versiones 2.1.4 y 2.0.4 contendrán la corrección."
    }
  ],
  "lastModified": "2026-06-17T02:16:06.833",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:ozlabs:patchwork:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "8678FB71-AAB7-4EC9-A6DF-CF84CECA0618",
              "versionEndExcluding": "2.0.4",
              "versionStartIncluding": "1.1"
            },
            {
              "criteria": "cpe:2.3:a:ozlabs:patchwork:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "1BD9CF3A-385F-4EE3-8FE3-2E18E3432A61",
              "versionEndExcluding": "2.1.4",
              "versionStartIncluding": "2.1.0"
            },
            {
              "criteria": "cpe:2.3:a:ozlabs:patchwork:2.1.0:rc1:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "AF61E1F9-98D2-49A2-9CA9-58640EFBB7EF"
            },
            {
              "criteria": "cpe:2.3:a:ozlabs:patchwork:2.1.0:rc2:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "CA6BEA6A-D49C-49D6-A8E6-1F4EDC348724"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "cve@mitre.org"
}