-
Notifications
You must be signed in to change notification settings - Fork 2
/
PSF-2019-6.json
53 lines (53 loc) · 1.55 KB
/
PSF-2019-6.json
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
{
"modified": "2021-04-17T21:06:13Z",
"published": "2019-09-28T01:33:02Z",
"schema_version": "1.5.0",
"id": "PSF-2019-6",
"aliases": [
"CVE-2019-16935"
],
"summary": "Reflected XSS in DocXMLRPCServer",
"details": "The documentation XML-RPC server in Python through 2.7.16, 3.x through 3.6.9, and 3.7.x through 3.7.4 has XSS via the server_title field. This occurs in Lib/DocXMLRPCServer.py in Python 2.x, and in Lib/xmlrpc/server.py in Python 3.x. If set_server_title is called with untrusted input, arbitrary JavaScript can be delivered to clients that visit the http URL for this server.",
"affected": [
{
"ranges": [
{
"type": "GIT",
"events": [
{
"introduced": "0"
},
{
"fixed": "1698cacfb924d1df452e78d11a4bf81ae7777389"
},
{
"fixed": "39a0c7555530e31c6941a78da19b6a5b61170687"
},
{
"fixed": "3fe1b19265b55c290fc956e9aafcf661803782de"
},
{
"fixed": "6447b9f9bd27e1f6b04cef674dd3a7ab27bf4f28"
},
{
"fixed": "8eb64155ff26823542ccf0225b3d57b6ae36ea89"
},
{
"fixed": "e8650a4f8c7fb76f570d4ca9c1fbe44e91c8dfaa"
}
],
"repo": "https://github.com/python/cpython"
}
]
}
],
"database_specific": {
"cwe_ids": []
},
"references": [
{
"type": "REPORT",
"url": "https://bugs.python.org/issue38243"
}
]
}