CVE-2011-4312
Summary
| CVE | CVE-2011-4312 |
|---|---|
| State | PUBLISHED |
| Assigner | redhat |
| Source Priority | CVE Program / NVD first with legacy fallback |
| Published | 2011-11-24 04:01:06 UTC |
| Updated | 2026-04-29 01:13:23 UTC |
| Description | Multiple cross-site scripting (XSS) vulnerabilities in the commenting system in Review Board before 1.5.7 and 1.6.x before 1.6.3 allow remote attackers to inject arbitrary web script or HTML via vectors involving the (1) diff viewer or (2) screenshot component. |
Risk And Classification
CVSS v2.0 Breakdown
Access Vector
NetworkAccess Complexity
MediumAuthentication
NoneConfidentiality
NoneIntegrity
PartialAvailability
NoneAV:N/AC:M/Au:N/C:N/I:P/A:N
NVD Known Affected Configurations (CPE 2.3)
| Type | Vendor | Product | Version | Update | Edition | Language |
|---|---|---|---|---|---|---|
| Application | Reviewboard | Review Board | 1.0 | All | All | All |
| Application | Reviewboard | Review Board | 1.0 | alpha1 | All | All |
| Application | Reviewboard | Review Board | 1.0 | alpha2 | All | All |
| Application | Reviewboard | Review Board | 1.0 | alpha3 | All | All |
| Application | Reviewboard | Review Board | 1.0 | alpha4 | All | All |
| Application | Reviewboard | Review Board | 1.0 | beta1 | All | All |
| Application | Reviewboard | Review Board | 1.0 | beta2 | All | All |
| Application | Reviewboard | Review Board | 1.0 | rc1 | All | All |
| Application | Reviewboard | Review Board | 1.0 | rc2 | All | All |
| Application | Reviewboard | Review Board | 1.0 | rc3 | All | All |
| Application | Reviewboard | Review Board | 1.0.1 | All | All | All |
| Application | Reviewboard | Review Board | 1.0.2 | All | All | All |
| Application | Reviewboard | Review Board | 1.0.3 | All | All | All |
| Application | Reviewboard | Review Board | 1.0.4 | All | All | All |
| Application | Reviewboard | Review Board | 1.0.5 | All | All | All |
| Application | Reviewboard | Review Board | 1.0.5.1 | All | All | All |
| Application | Reviewboard | Review Board | 1.0.6 | All | All | All |
| Application | Reviewboard | Review Board | 1.0.7 | All | All | All |
| Application | Reviewboard | Review Board | 1.0.8 | All | All | All |
| Application | Reviewboard | Review Board | 1.0.9 | All | All | All |
| Application | Reviewboard | Review Board | 1.1 | alpha1 | All | All |
| Application | Reviewboard | Review Board | 1.1 | alpha2 | All | All |
| Application | Reviewboard | Review Board | 1.5 | All | All | All |
| Application | Reviewboard | Review Board | 1.5 | beta1 | All | All |
| Application | Reviewboard | Review Board | 1.5 | beta2 | All | All |
| Application | Reviewboard | Review Board | 1.5 | rc1 | All | All |
| Application | Reviewboard | Review Board | 1.5 | rc2 | All | All |
| Application | Reviewboard | Review Board | 1.5.1 | All | All | All |
| Application | Reviewboard | Review Board | 1.5.2 | All | All | All |
| Application | Reviewboard | Review Board | 1.5.3 | All | All | All |
| Application | Reviewboard | Review Board | 1.5.4 | All | All | All |
| Application | Reviewboard | Review Board | 1.5.5 | All | All | All |
| Application | Reviewboard | Review Board | 1.6 | All | All | All |
| Application | Reviewboard | Review Board | 1.6 | beta1 | All | All |
| Application | Reviewboard | Review Board | 1.6 | beta2 | All | All |
| Application | Reviewboard | Review Board | 1.6 | rc1 | All | All |
| Application | Reviewboard | Review Board | 1.6 | rc2 | All | All |
| Application | Reviewboard | Review Board | 1.6.1 | All | All | All |
| Application | Reviewboard | Review Board | 1.6.2 | All | All | All |
| Application | Reviewboard | Review Board | All | All | All | All |
Vendor Declared Affected Products
References
| Reference | Source | Link | Tags |
|---|---|---|---|
| oss-security - CVE Request -- ReviewBoard v1.5.7 && v1.6.3 -- XSS in the commenting system (diff viewer and screenshot pages components) | af854a3a-2127-422b-91ae-364da2661108 | www.openwall.com | |
| oss-security - Re: CVE Request -- ReviewBoard v1.5.7 && v1.6.3 -- XSS in the commenting system (diff viewer and screenshot pages components) | af854a3a-2127-422b-91ae-364da2661108 | www.openwall.com | |
| ReviewBoard Commenting System Cross Site Scripting Vulnerability | af854a3a-2127-422b-91ae-364da2661108 | www.securityfocus.com | |
| Review Board 1.6.3 Release Notes | Documentation | Review Board | af854a3a-2127-422b-91ae-364da2661108 | www.reviewboard.org | |
| [SECURITY] Fedora 16 Update: ReviewBoard-1.6.3-1.fc16 | af854a3a-2127-422b-91ae-364da2661108 | lists.fedoraproject.org | |
| Security Advisory SA46840 - ReviewBoard Diff and Screenshot Comments Script Insertion Vulnerabilities - Secunia | af854a3a-2127-422b-91ae-364da2661108 | secunia.com | |
| 754126 – (CVE-2011-4312) CVE-2011-4312 ReviewBoard: XSS in the commenting system (diff viewer and screenshot pages) | af854a3a-2127-422b-91ae-364da2661108 | bugzilla.redhat.com | |
| [SECURITY] Fedora 15 Update: ReviewBoard-1.5.7-1.fc15 | af854a3a-2127-422b-91ae-364da2661108 | lists.fedoraproject.org | |
| Fix a comment vulnerability allowing scripts to be loaded. · reviewboard/reviewboard@7a0a9d9 · GitHub | af854a3a-2127-422b-91ae-364da2661108 | github.com | Patch |
| CVE Program record | CVE.ORG | www.cve.org | canonical |
| NVD vulnerability detail | NVD | nvd.nist.gov | canonical, analysis |
No vendor comments have been submitted for this CVE.
There are currently no legacy QID mappings associated with this CVE.