CVE-2003-0154 Cross-site scripting in n/a
Remote attackers can execute arbitrary web script via crafted parameters in the Bonsai Mozilla CVS query tool, requiring user interaction to trigger.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2003-0154?
CVE-2003-0154 is a medium-severity cross-site scripting vulnerability in n/a, published on 26 Mar 2003. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
Cross-site scripting vulnerabilities (XSS) in bonsai Mozilla CVS query tool allow remote attackers to execute arbitrary web script via (1) the file, root, or rev parameters to cvslog.cgi, (2) the file or root parameters to cvsblame.cgi, (3) various parameters to cvsquery.cgi, (4) the person parameter to showcheckins.cgi, (5) the module parameter to cvsqueryform.cgi, and (6) possibly other attack vectors as identified by Mozilla bug #146244.
Which versions are affected by CVE-2003-0154?
It affects 1 product.
Products include Mozilla Bonsai.
How do I fix CVE-2003-0154?
Apply the vendor's patch.
Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.
Is CVE-2003-0154 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2003-0154 exists.
Public exploit code: 1 Exploit-DB entry.
Other vulnerabilities in n/a
Sources
Also known as GHSA-jxf4-6hgg-qvgr.