CVE-2019-10904

NONE EPSS 72.2%
Published Apr 6, 20197y ago · Modified Jun 17, 20262w ago
Find Similar
Published Apr 6, 2019 7y ago
Last Modified Jun 17, 2026 2w ago

Description

Roundup 1.6 allows XSS via the URI because frontends/roundup.cgi and roundup/cgi/wsgi_handler.py mishandle 404 errors.

Threat Intelligence

EPSS Exploit Probability
72.2% percentile
Exploit & Patch Status
Public Exploit Known
No Patch Available

Weaknesses 1

CWE-79 Cross-site Scripting Injection

Affected Products 2

VendorProductVersionRange
debiandebian_linux8.0any
roundup-trackerroundup1.6any

References 5

  • openwall.com http://www.openwall.com/lists/oss-security/2019/04/07/1
    ExploitMailing ListThird Party Advisory
  • bugs.python.org https://bugs.python.org/issue36391
    ExploitVendor Advisory
  • github.com https://github.com/python/bugs.python.org/issues/34
    ExploitIssue TrackingThird Party Advisory
  • lists.debian.org https://lists.debian.org/debian-lts-announce/2019/04/msg00009.html
    Mailing ListThird Party Advisory
  • openwall.com https://www.openwall.com/lists/oss-security/2019/04/05/1
    Mailing ListThird Party Advisory

Remediation

No remediation data recorded yet

Check vendor advisories and the NVD entry for patch availability.