01 Record

CVE-2019-13122

A Cross Site Scripting (XSS) vulnerability exists in the template tag used to render message ids in Patchwork v1.1 through v2.1.x. This allows an attacker to insert JavaScript or HTML into the patch

UnratedPUBLISHEDCNA: mitre

CNA base scoreUnratedNo CNA CVSS vector

View raw JSON

02 Description

A Cross Site Scripting (XSS) vulnerability exists in the template tag used to render message ids in Patchwork v1.1 through v2.1.x. This allows an attacker to insert JavaScript or HTML into the patch

03 Exploitation and scoring

Exploitation: Not assessed. CISA has not published an exploitation assessment for this record, and it is not in the KEV catalog. That is an absence of assessment, not a finding of no risk.
SSVC decision: Not assessed by CISA
EPSS probability: 1.34% probability of exploitation activity in the next 30 days.
EPSS percentile: Ranks above 69.3% of scored records. A rank, not a probability.
NVD base score: 6.1 (CVSS v3.x), scored by the NVD independently of the CNA.
NVD CVSS vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
NVD analysis status: Modified. NVD last modified this record on 2026-06-17.
Red Hat severity: No Red Hat rating. Red Hat rates the CVEs that affect its products.

Exploit-prediction scores from FIRST. Independent scoring and analysis status from the NVD. Vendor severity from Red Hat. Exploitation assessment and catalog membership from CISA.

04 Metadata

Published

2019-07-10 16:38Z7 YR AGO

Last updated

2024-08-04 23:41Z2 YR AGO

Reserved

2019-07-01

Assigning CNA

mitre

Record state

PUBLISHED

Severity

Not rated by the issuing CNA

CNA CVSS vector

Not published by the issuing CNA

Weaknesses

CWE-79Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')Base

Data version

5.1

Document digest

9855fcaf5f63fedd243b08cf9af73e75aee4a91ee37ec9247b365460396f5dae

05 Affected products

VendorProductVersionsPlatforms

ozlabspatchworkNot specified—

06 References

github.comhttps://github.com/getpatchwork/patchwork/releasesx_refsource_MISC
github.comhttps://github.com/getpatchwork/patchwork/commits/masterx_refsource_MISC
lists.ozlabs.orghttps://lists.ozlabs.org/pipermail/patchwork/2019-July/date.htmlx_refsource_MISC
jk.ozlabs.orghttp://jk.ozlabs.org/projects/patchwork/x_refsource_MISC
www.openwall.com[oss-security] 20190705 CVE-2019-13122: Patchwork: XSS via Message-IDhttp://www.openwall.com/lists/oss-security/2019/07/05/1mailing-listx_refsource_MLIST
lists.ozlabs.orghttps://lists.ozlabs.org/pipermail/patchwork/2019-July/005870.htmlx_refsource_MISC
lists.ozlabs.orghttps://lists.ozlabs.org/pipermail/patchwork/2019-July/005878.htmlx_refsource_MISC

01 Record index

CVE-2019-13122

02 Description

03 Exploitation and scoring

04 Metadata

05 Affected products

06 References

02 Records

CVE-2019-13122

02 Description

03 Exploitation and scoring

04 Metadata

05 Affected products

06 References