ReviewBoard full name script insertion Vulnerability

Release date:
Updated on: 2013-06-26

Affected Systems:
Reviewboard 1.x
Description:
--------------------------------------------------------------------------------
CVE (CAN) ID: CVE-2013-2209
 
ReviewBoard is an open-source code review application.
 
ReviewBoard versions earlier than 1.7.10 and earlier than 1.6.17 do not properly filter users' full names, which may cause arbitrary HTML and script code to be inserted and then executed in user browser sessions.
 
<* Source: Craig Young

Link: http://secunia.com/advisories/53898/
*>

Suggestion:
--------------------------------------------------------------------------------
Vendor patch:
 
Reviewboard
-----------
The vendor has released a patch to fix this security problem. Please download it from the vendor's homepage:
 
Http://www.reviewboard.org