CVE catalog

CVE-2017-5938

UBUNTU-CVE-2017-5938

[CVE catalog]

Severity
Medium · CVSS 6.1CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Published
Updated
Source
[NVD] · [CVE record]
EPSS
1.32% · Oct 25, 2026

Cross-site scripting (XSS) vulnerability in the nav_path function in lib/viewvc.py in ViewVC before 1.0.14 and 1.1.x before 1.1.26 allows remote attackers to inject arbitrary web script or HTML via the nav_data name.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

DistributionPackageReleaseVersionStatus
Debianviewvc71.1.5-1.4vulnerable
Debianviewvc71.1.5-1.4+deb7u1fixed
Debianviewvc81.1.22-1vulnerable
Debianviewvc81.1.22-1+deb8u1fixed
Opensuseviewvctumbleweed1.3.0~dev20230104-1.1fixed
Ubuntuviewvc14.041.1.5-1.4vulnerable
Ubuntuviewvc14.041.1.5-1.4+deb7u1build0.14.04.1fixed
Ubuntuviewvc16.041.1.22-1vulnerable
Ubuntuviewvc16.041.1.22-1+deb8u1build0.16.04.1fixed

Fixed-version evidence

DistributionPackageTypeReleaseFixed versionUrgencyOriginBugs
Debianviewvcdeb71.1.5-1.4+deb7u1Not reportedDLA-820-1Not reported
Debianviewvcdeb81.1.22-1+deb8u1Not reportedDSA-3784-1Not reported
Opensuseviewvcrpmtumbleweed1.3.0~dev20230104-1.1Not reportedOPENSUSE-SU-2024:12857-1Not reported
Ubuntuviewvcdeb14.041.1.5-1.4+deb7u1build0.14.04.1Not reportedUBUNTU-CVE-2017-5938Not reported
Ubuntuviewvcdeb16.041.1.22-1+deb8u1build0.16.04.1Not reportedUBUNTU-CVE-2017-5938Not reported

OpenFactory catalog packages

[openSUSE Tumbleweed]

  • [viewvc]Fixed

    Source package: [viewvc]

    Details (1)

    • 1.3.0~dev20250722-1.3 · noarch · tumbleweed

      Fixed · Fixed: 1.3.0~dev20230104-1.1

      pypi · viewvc · opensuse · tumbleweed

Observed:

References

[FIRST EPSS] · [OSV Package Vulnerability Database] · [SUSE security advisories and VEX]