Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
5.3

Review Board website allows attackers to inject malicious scripts

CVE-2014-3994 · published 12 years ago
Summary

Review Board's website is vulnerable to a security issue that allows attackers to inject malicious scripts. This means that if an attacker tricks a Review Board user into clicking on a link or viewing a specially crafted page, they could potentially take control of the user's account or steal their personal data. Update Review Board to the latest version to fix this issue.

What to do
  • Update beanbag djblets to version 0.7.30.
  • Update beanbag djblets to version 0.8.3.
Affected software
Ecosystem VendorProductAffected versions
pip beanbag djblets < 0.7.30
>= 0.8, < 0.8.3
Fix: upgrade to 0.7.30
– reviewboard djblets <= 0.7.29
0.7.27
0.7.28
0.8.1
0.8.2
cpe:2.3:a:reviewboard:djblets:*:*:*:*:*:*:*:*
– reviewboard reviewboard All versions
cpe:2.3:a:reviewboard:reviewboard:-:*:*:*:*:*:*:*
Original advisory text
Cross-site scripting (XSS) vulnerability in util/templatetags/djblets_js.py in Djblets before 0.7.30 and 0.8.x before 0.8.3 for Django, as used in Review Board, allows remote attackers to inject ar...
Cross-site scripting (XSS) vulnerability in util/templatetags/djblets_js.py in Djblets before 0.7.30 and 0.8.x before 0.8.3 for Django, as used in Review Board, allows remote attackers to inject arbitrary web script or HTML via a JSON object, as demonstrated by the name field when changing a user name.
References
Fix within
Internet-facing 60 days
Internal At next upgrade
  • Not known to be exploited
  • Needs hands-on effort to exploit (estimated)
  • Gives an attacker partial control (estimated)
Severity
5.3 Medium
Exploitation
2% chance of attack within 30 days
Type
CWE-79Cross-site Scripting (XSS)
Timeline
Published16 Jun 2014
Updated29 Oct 2026
First seen6 Mar 2026
Sources
GHSA-w7rq-8f2g-jvqr · GHSA
CVE-2014-3994 · NVD
Track software like this
Free during beta