CVEvulnerability
CVE-2015-1864
5.4 MEDIUM
Official page ↗
- Status
- Modified
- Published
- 2017-09-19
- Last modified
- 2026-06-17
- Assigner
- [email protected]
- CVSS 3.0 ([email protected])
- 5.4 MEDIUM — CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
- CVSS 2.0 ([email protected])
- 3.5 LOW — AV:N/AC:M/Au:S/C:N/I:P/A:N
- Weaknesses
- CWE-79
Description
Multiple cross-site scripting (XSS) vulnerabilities in the administration pages in Kallithea before 0.2.1 allow remote attackers to inject arbitrary web script or HTML via the (1) first name or (2) last name user details, or the (3) repository, (4) repository group, or (5) user group description.
Affected configurations
• kallithea-scm kallithea 0.1
• kallithea-scm kallithea 0.2
Related
Weakness · CWE (1)
- CWE-79 Improper Neutralization of Input During Web Page Generation weakness
References
- http://www.openwall.com/lists/oss-security/2015/04/14/12 Exploit, Mailing List, Third Party Advisory
- http://www.securityfocus.com/bid/74184 Third Party Advisory, VDB Entry
- https://kallithea-scm.org/repos/kallithea/changeset/a8f2986afc18c9221bf99f88b06e60ab83c86c55 Patch
- https://kallithea-scm.org/security/cve-2015-1864.html Exploit, Vendor Advisory
- http://www.openwall.com/lists/oss-security/2015/04/14/12 Exploit, Mailing List, Third Party Advisory
- http://www.securityfocus.com/bid/74184 Third Party Advisory, VDB Entry
- https://kallithea-scm.org/repos/kallithea/changeset/a8f2986afc18c9221bf99f88b06e60ab83c86c55 Patch
- https://kallithea-scm.org/security/cve-2015-1864.html Exploit, Vendor Advisory