CVE and update status of the FreeBSD ports tree3,295 unaddressed CVEs in 670 portsAll times are CET
CVE details

CVE-2018-1000998

FreeBSD CVSweb version 2.x contains a Cross Site Scripting (XSS) vulnerability in all pages that can result in limited impact--CVSweb is anonymous & read-only. It might impact other sites on same domain. This attack appears to be exploitable via victim must load specially crafted url. This vulnerability appears to have been fixed in 3.x.

Score
6.1 medium
Published
2019-02-04
Links
NVD · cve.org · Report wrong data

Matched ports (1)

PortPackageVersionStatusMaintainer
devel/cvswebcvsweb2.0.6_2unaddressednoackjr@alumni.rice.edu

Template for a VuXML entry

Range taken from the CVE record, check it before committing. make newentry in security/vuxml creates the vid.

  <vuln vid="FIXME (make newentry)">
    <topic>FIXME -- FIXME</topic>
    <affects>
      <package>
	<name>cvsweb</name>
	<range><lt>FIXME</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>FreeBSD CVSweb version 2.x contains a Cross Site Scripting (XSS)
	vulnerability in all pages that can result in limited impact--CVSweb
	is anonymous & read-only. It might impact other sites on same domain.
	This attack appears to be exploitable via victim must load specially
	crafted url. This vulnerability appears to have been fixed in 3.x.</p>
      </body>
    </description>
    <references>
      <cvename>CVE-2018-1000998</cvename>
      <url>https://nvd.nist.gov/vuln/detail/CVE-2018-1000998</url>
    </references>
    <dates>
      <discovery>2019-02-04</discovery>
      <entry>2026-10-26</entry>
    </dates>
  </vuln>