{"id":"CVE-2013-4181","aliases":["EUVD-2013-4104","GHSA-q75j-qph2-cwg9","RHSA-2013:1210"],"status":"published","title":"Cross-site scripting (XSS) vulnerability in the addAlert function in the RedirectServlet servlet...","description":"Cross-site scripting (XSS) vulnerability in the addAlert function in the RedirectServlet servlet in oVirt Engine and Red Hat Enterprise Virtualization Manager (RHEV-M), as used in Red Hat Enterprise Virtualization 3 and 3.2, allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.","severity":{"version":"2.0","score":4.3,"vector":"AV:N/AC:M/Au:N/C:N/I:P/A:N","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-07","score":0.01412,"percentile":0.72853,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-79"],"published":"2013-09-16T19:00:00Z","modified":"2026-06-29T10:05:45Z","fixes":[{"ecosystem":"Red Hat:rhev_manager:3","package":"rhevm","fixed_in":["0:3.2.3-0.42.el6ev"],"sources":["osv"]},{"ecosystem":"Red Hat:rhev_manager:3","package":"rhevm-backend","fixed_in":["0:3.2.3-0.42.el6ev"],"sources":["osv"]},{"ecosystem":"Red Hat:rhev_manager:3","package":"rhevm-config","fixed_in":["0:3.2.3-0.42.el6ev"],"sources":["osv"]},{"ecosystem":"Red Hat:rhev_manager:3","package":"rhevm-dbscripts","fixed_in":["0:3.2.3-0.42.el6ev"],"sources":["osv"]},{"ecosystem":"Red Hat:rhev_manager:3","package":"rhevm-genericapi","fixed_in":["0:3.2.3-0.42.el6ev"],"sources":["osv"]},{"ecosystem":"Red Hat:rhev_manager:3","package":"rhevm-notification-service","fixed_in":["0:3.2.3-0.42.el6ev"],"sources":["osv"]},{"ecosystem":"Red Hat:rhev_manager:3","package":"rhevm-restapi","fixed_in":["0:3.2.3-0.42.el6ev"],"sources":["osv"]},{"ecosystem":"Red Hat:rhev_manager:3","package":"rhevm-setup","fixed_in":["0:3.2.3-0.42.el6ev"],"sources":["osv"]},{"ecosystem":"Red Hat:rhev_manager:3","package":"rhevm-setup-plugin-allinone","fixed_in":["0:3.2.3-0.42.el6ev"],"sources":["osv"]},{"ecosystem":"Red Hat:rhev_manager:3","package":"rhevm-tools-common","fixed_in":["0:3.2.3-0.42.el6ev"],"sources":["osv"]},{"ecosystem":"Red Hat:rhev_manager:3","package":"rhevm-userportal","fixed_in":["0:3.2.3-0.42.el6ev"],"sources":["osv"]},{"ecosystem":"Red Hat:rhev_manager:3","package":"rhevm-webadmin-portal","fixed_in":["0:3.2.3-0.42.el6ev"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Red Hat:rhev_manager:3","package":"rhevm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.2.3-0.42.el6ev"}]}]},{"source":"osv","ecosystem":"Red Hat:rhev_manager:3","package":"rhevm-backend","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.2.3-0.42.el6ev"}]}]},{"source":"osv","ecosystem":"Red Hat:rhev_manager:3","package":"rhevm-config","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.2.3-0.42.el6ev"}]}]},{"source":"osv","ecosystem":"Red Hat:rhev_manager:3","package":"rhevm-dbscripts","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.2.3-0.42.el6ev"}]}]},{"source":"osv","ecosystem":"Red Hat:rhev_manager:3","package":"rhevm-genericapi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.2.3-0.42.el6ev"}]}]},{"source":"osv","ecosystem":"Red Hat:rhev_manager:3","package":"rhevm-notification-service","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.2.3-0.42.el6ev"}]}]},{"source":"osv","ecosystem":"Red Hat:rhev_manager:3","package":"rhevm-restapi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.2.3-0.42.el6ev"}]}]},{"source":"osv","ecosystem":"Red Hat:rhev_manager:3","package":"rhevm-setup","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.2.3-0.42.el6ev"}]}]},{"source":"osv","ecosystem":"Red Hat:rhev_manager:3","package":"rhevm-setup-plugin-allinone","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.2.3-0.42.el6ev"}]}]},{"source":"osv","ecosystem":"Red Hat:rhev_manager:3","package":"rhevm-tools-common","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.2.3-0.42.el6ev"}]}]},{"source":"osv","ecosystem":"Red Hat:rhev_manager:3","package":"rhevm-userportal","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.2.3-0.42.el6ev"}]}]},{"source":"osv","ecosystem":"Red Hat:rhev_manager:3","package":"rhevm-webadmin-portal","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.2.3-0.42.el6ev"}]}]}],"products":[{"vendor":"redhat","product":"enterprise_virtualization"}],"references":[{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=988774","tags":["x_refsource_CONFIRM","x_transferred","report"]},{"url":"http://rhn.redhat.com/errata/RHSA-2013-1210.html","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred","Vendor Advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2013-4181","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2013:1210","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2013-4181","tags":["report"]},{"url":"https://github.com/advisories/GHSA-q75j-qph2-cwg9"},{"url":"https://access.redhat.com/security/updates/classification/#moderate","tags":["article"]},{"url":"https://access.redhat.com/site/documentation/en-US/Red_Hat_Enterprise_Virtualization/3.2/html/Installation_Guide/Upgrading_between_Minor_Releases.html","tags":["article"]},{"url":"https://access.redhat.com/site/documentation/en-US/Red_Hat_Enterprise_Virtualization/3.2/html/Technical_Notes/chap-RHSA-2013-1210.html","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=988048","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=991542","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=993014","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=994100","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=996125","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=996127","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=996854","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=996970","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=997394","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=997426","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=998240","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=998254","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=998520","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=998523","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=998539","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=999060","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=999224","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2013/rhsa-2013_1210.json","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2013-4181","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2013-4181","description":"Cross-site scripting (XSS) vulnerability in the addAlert function in the RedirectServlet servlet in oVirt Engine and Red Hat Enterprise Virtualization Manager (RHEV-M), as used in Red Hat Enterprise Virtualization 3 and 3.2, allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.","status":"published","published":"2013-09-16T19:00:00Z","modified":"2024-08-06T16:38:01.478Z","updated_at":"2026-11-02T14:34:57.869657Z"}],"euvd":[{"id":"EUVD-2013-4104","description":"Cross-site scripting (XSS) vulnerability in the addAlert function in the RedirectServlet servlet in oVirt Engine and Red Hat Enterprise Virtualization Manager (RHEV-M), as used in Red Hat Enterprise Virtualization 3 and 3.2, allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.","status":"published","published":"2013-09-16T19:00:00Z","modified":"2024-08-06T16:38:01Z","updated_at":"2026-11-03T01:56:32.70868Z"}],"ghsa":[{"id":"GHSA-q75j-qph2-cwg9","title":"Cross-site scripting (XSS) vulnerability in the addAlert function in the RedirectServlet servlet...","description":"Cross-site scripting (XSS) vulnerability in the addAlert function in the RedirectServlet servlet in oVirt Engine and Red Hat Enterprise Virtualization Manager (RHEV-M), as used in Red Hat Enterprise Virtualization 3 and 3.2, allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.","status":"published","published":"2022-05-17T05:04:19Z","modified":"2023-02-10T05:06:26Z","cwes":["CWE-79"],"updated_at":"2026-11-02T14:54:01.789224Z"}],"nvd":[{"id":"CVE-2013-4181","description":"Cross-site scripting (XSS) vulnerability in the addAlert function in the RedirectServlet servlet in oVirt Engine and Red Hat Enterprise Virtualization Manager (RHEV-M), as used in Red Hat Enterprise Virtualization 3 and 3.2, allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.","status":"published","published":"2013-09-16T19:14:38.817Z","modified":"2026-06-16T23:56:46.187Z","cvss":[{"version":"2.0","score":4.3,"vector":"AV:N/AC:M/Au:N/C:N/I:P/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:02:35.248411Z"}],"osv":[{"id":"RHSA-2013:1210","title":"Red Hat Security Advisory: rhevm security and bug fix update","status":"published","published":"2024-09-13T08:26:27Z","modified":"2026-06-29T10:05:45Z","updated_at":"2026-11-02T15:53:01.993625Z"}]}}