CVE-2013-4204

Multiple cross-site scripting (XSS) vulnerabilities in the JUnit files in the GWTTestCase in Google Web Toolkit (GWT) before 2.5.1 RC1 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors.

Published Bysecalert@redhat.com

Published DateNov 18, 2013, 02:55

Affected Versions(1)

com.google.gwt:gwt(Maven)

Introduced0

Fixed2.5.1

LimitN/A

Package (Ecosystem)	Introduced	Fixed	Limit
com.google.gwt:gwt(Maven)	0	2.5.1	N/A

Weakness Type (CWE):CWE-79

CVSS Metrics

Base Score

4.3

Vector String

AV:N/AC:M/Au:N/C:N/I:P/A:N

Base Severity

Version

2.0

Attack Vector (AV)

Attack Complexity (AC)

Privileges Required (PR)

User Interaction (UI)

Scope (S)

Confidentiality (C)

NONE

Integrity (I)

PARTIAL

Availability (A)

NONE

References

http://www.gwtproject.org/release-notes.html#Release_Notes_2_5_1_RC1
http://www.openwall.com/lists/oss-security/2013/08/05/1
http://www.openwall.com/lists/oss-security/2013/08/05/3
http://www.securityfocus.com/bid/61590

Weakness Type (CWE):CWE-79

CVSS Metrics

Base Score

4.3

Vector String

AV:N/AC:M/Au:N/C:N/I:P/A:N

Base Severity

Version

2.0

Attack Vector (AV)

Attack Complexity (AC)

Privileges Required (PR)

User Interaction (UI)

Scope (S)

Confidentiality (C)

NONE

Integrity (I)

PARTIAL

Availability (A)

NONE