{"id":"CVE-2013-2209","aliases":["EUVD-2022-2789","GHSA-6g7x-4c7m-g63m","PYSEC-2026-913"],"status":"published","title":"Review Board Cross-site scripting (XSS) vulnerability in the reviews dropdown","description":"Cross-site scripting (XSS) vulnerability in the auto-complete widget in htdocs/media/rb/js/reviews.js in Review Board 1.6.x before 1.6.17 and 1.7.x before 1.7.10 allows remote attackers to inject arbitrary web script or HTML via a full name.","severity":{"version":"2.0","score":4.3,"vector":"AV:N/AC:M/Au:N/C:N/I:P/A:N","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-09","score":0.02182,"percentile":0.82498,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-79"],"published":"2013-07-31T10:00:00Z","modified":"2026-07-07T11:56:11Z","fixes":[{"ecosystem":"PyPI","package":"reviewboard","fixed_in":["1.6.17","1.7.10"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"PyPI","package":"reviewboard","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.6"},{"fixed":"1.6.17"}]}]},{"source":"ghsa","ecosystem":"PyPI","package":"reviewboard","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.7"},{"fixed":"1.7.10"}]}]},{"source":"osv","ecosystem":"PyPI","package":"reviewboard","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.6"},{"fixed":"1.6.17"}]}],"versions":["1.6","1.6.1","1.6.10","1.6.11","1.6.12","1.6.13","1.6.14","1.6.15","1.6.16","1.6.2","1.6.3","1.6.4","1.6.4.1","1.6.5","1.6.6","1.6.7","1.6.7.1","1.6.8","1.6.9"]},{"source":"osv","ecosystem":"PyPI","package":"reviewboard","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.7"},{"fixed":"1.7.10"}]}],"versions":["1.7","1.7.0.1","1.7.1","1.7.2","1.7.3","1.7.4","1.7.5","1.7.6","1.7.7","1.7.7.1","1.7.8","1.7.9"]},{"source":"osv","ecosystem":"PyPI","package":"reviewboard","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.6"},{"fixed":"1.6.17"},{"introduced":"1.7"},{"fixed":"1.7.10"}]}],"versions":["1.6","1.6.1","1.6.10","1.6.11","1.6.12","1.6.13","1.6.14","1.6.15","1.6.16","1.6.2","1.6.3","1.6.4","1.6.4.1","1.6.5","1.6.6","1.6.7","1.6.7.1","1.6.8","1.6.9","1.7","1.7.0.1","1.7.1","1.7.2","1.7.3","1.7.4","1.7.5","1.7.6","1.7.7","1.7.7.1","1.7.8","1.7.9"]}],"products":[{"vendor":"reviewboard","product":"review_board"}],"references":[{"url":"http://www.tripwire.com/state-of-security/vulnerability-management/vulnerabilities-its-time-to-review-your-reviewboard","tags":["x_refsource_MISC","x_transferred","web"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=977423","tags":["x_refsource_CONFIRM","x_transferred","web"]},{"url":"http://www.reviewboard.org/news/2013/06/22/review-board-1617-and-1710-released/","tags":["x_refsource_CONFIRM","x_transferred","Vendor Advisory"]},{"url":"http://www.openwall.com/lists/oss-security/2013/06/24/2","tags":["mailing-list","x_refsource_MLIST","x_transferred","web"]},{"url":"https://github.com/reviewboard/reviewboard/commit/4aaacbb1e628a80803ba1a55703db38fccdf7dbf","tags":["x_refsource_CONFIRM","x_transferred","Exploit","Patch","web"]},{"url":"http://www.reviewboard.org/docs/releasenotes/reviewboard/1.6.17/","tags":["x_refsource_CONFIRM","x_transferred"]},{"url":"http://www.reviewboard.org/docs/releasenotes/reviewboard/1.7.10/","tags":["x_refsource_CONFIRM","x_transferred"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2013-2209","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-6g7x-4c7m-g63m","tags":["advisory"]},{"url":"https://github.com/reviewboard/reviewboard","tags":["package"]},{"url":"http://www.reviewboard.org/docs/releasenotes/reviewboard/1.6.17","tags":["web"]},{"url":"http://www.reviewboard.org/docs/releasenotes/reviewboard/1.7.10","tags":["web"]},{"url":"http://www.reviewboard.org/news/2013/06/22/review-board-1617-and-1710-released","tags":["web"]},{"url":"https://pypi.org/project/reviewboard","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2013-2209","description":"Cross-site scripting (XSS) vulnerability in the auto-complete widget in htdocs/media/rb/js/reviews.js in Review Board 1.6.x before 1.6.17 and 1.7.x before 1.7.10 allows remote attackers to inject arbitrary web script or HTML via a full name.","status":"published","published":"2013-07-31T10:00:00Z","modified":"2024-08-06T15:27:41.089Z","updated_at":"2026-11-02T14:34:56.19172Z"}],"euvd":[{"id":"EUVD-2022-2789","description":"Cross-site scripting (XSS) vulnerability in the auto-complete widget in htdocs/media/rb/js/reviews.js in Review Board 1.6.x before 1.6.17 and 1.7.x before 1.7.10 allows remote attackers to inject arbitrary web script or HTML via a full name.","status":"published","published":"2013-07-31T10:00:00Z","modified":"2024-08-06T15:27:41Z","updated_at":"2026-11-03T01:56:39.164386Z"}],"ghsa":[{"id":"GHSA-6g7x-4c7m-g63m","title":"Review Board Cross-site scripting (XSS) vulnerability in the reviews dropdown","description":"Cross-site scripting (XSS) vulnerability in the auto-complete widget in htdocs/media/rb/js/reviews.js in Review Board 1.6.x before 1.6.17 and 1.7.x before 1.7.10 allows remote attackers to inject arbitrary web script or HTML via a full name.","status":"published","published":"2022-05-17T04:46:29Z","modified":"2023-08-29T18:42:55Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:N/I:H/A:N","level":"medium"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:37:01.345964Z"}],"nvd":[{"id":"CVE-2013-2209","description":"Cross-site scripting (XSS) vulnerability in the auto-complete widget in htdocs/media/rb/js/reviews.js in Review Board 1.6.x before 1.6.17 and 1.7.x before 1.7.10 allows remote attackers to inject arbitrary web script or HTML via a full name.","status":"published","published":"2013-07-31T13:20:25.557Z","modified":"2026-06-16T23:52:57.01Z","cvss":[{"version":"2.0","score":4.3,"vector":"AV:N/AC:M/Au:N/C:N/I:P/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:02:31.592595Z"}],"osv":[{"id":"GHSA-6g7x-4c7m-g63m","title":"Review Board Cross-site scripting (XSS) vulnerability in the reviews dropdown","description":"Cross-site scripting (XSS) vulnerability in the auto-complete widget in htdocs/media/rb/js/reviews.js in Review Board 1.6.x before 1.6.17 and 1.7.x before 1.7.10 allows remote attackers to inject arbitrary web script or HTML via a full name.","status":"published","published":"2022-05-17T04:46:29Z","modified":"2026-07-07T11:56:11.667823025Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:N/I:H/A:N","level":"medium"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T15:46:39.618611Z"},{"id":"PYSEC-2026-913","title":"Review Board Cross-site scripting (XSS) vulnerability in the reviews dropdown","description":"Cross-site scripting (XSS) vulnerability in the auto-complete widget in htdocs/media/rb/js/reviews.js in Review Board 1.6.x before 1.6.17 and 1.7.x before 1.7.10 allows remote attackers to inject arbitrary web script or HTML via a full name.","status":"published","published":"2026-07-06T08:03:26.495951Z","modified":"2026-07-07T11:45:50.11486146Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:N/I:H/A:N","level":"medium"}],"updated_at":"2026-11-02T15:52:58.117212Z"}]}}