CVE-2010-3906: git-scm git Cross-site Scripting

CVSS: 4.3v2.0MediumModified

AliasesRHSA-2010:1003DEBIAN-CVE-2010-3906

Published 17-12-2010Last modified 07-08-2024

Vulnerability summary

CVE-2010-3906 is a medium (CVSS 4.3) Cross-site Scripting vulnerability in git-scm git. EPSS estimates a 5.61% chance of exploitation in the next 30 days, higher than 92.8% of scored vulnerabilities. 2 public exploits are recorded.

Overall risk

28/100

0100

Medium · default modelHow is this calculated?

CVSS score

4.3/10

010

Medium · v2.0 (NVD)

EPSS score

5.61%

0%100%

Low · 0.00 pp in 30 days

KEVNot listedIn no KEV catalog

RansomwareNone recordedNo known use recorded

Public exploits2reference, exploit-database

Timeline

17-12-2010
PublishedVulnerability first disclosed.
07-08-2024
Last modifiedVulnerability information updated.

Description

Cross-site scripting (XSS) vulnerability in Gitweb 1.7.3.3 and earlier allows remote attackers to inject arbitrary web script or HTML via the (1) f and (2) fp parameters.

CVSS metrics

1 score · 1 source · 1 version

v2.04.3

EPSS trend

Probability

5.61%

Chance of exploitation in the next 30 days

Percentile

93%

Versus all other CVEs

30-day change

0.00 pp

From 5.61% on 18-09-2026

18-09-202618-10-2026

EPSS score

5.61%

Known exploited

Compare KEV catalogs

Not in any of the 3 tracked catalogs.

Public exploits

2 found

referenceUnverified
Exploit Reference (securityfocus.com)
Maturity: unknown
exploit-databasecgiVerified
gitWeb 1.7.3.3 - Cross-Site Scripting
Maturity: poc

Weaknesses

CWE · root cause

CWE-79Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Affected systems

Redhat13 products

emacs-git< 0:1.7.1-2.el6_0.1
emacs-git-el< 0:1.7.1-2.el6_0.1
git< 0:1.7.1-2.el6_0.1
git-all< 0:1.7.1-2.el6_0.1
git-cvs< 0:1.7.1-2.el6_0.1

Show all 13

Debian1 product

git< 1:1.7.2.3-2.2

Git1 product

git1.6.0.3 | 1.6.0.4 | 1.6.0.5 | 1.6.0.6 | 1.6.1 | 1.6.1:rc1 | 1.6.1:rc2 | 1.6.1:rc3 | 1.6.1:rc4 | 1.6.1.4 | 1.6.2 | 1.6.2:rc1 | 1.6.2.1 | 1.6.2.2 | 1.6.2.3 | 1.6.2.4 | 1.6.2.5 | 1.6.3 | 1.6.3:rc1 | 1.6.3:rc2 | 1.6.3:rc3 | 1.6.3:rc4 | 1.6.3.1 | 1.6.3.2 | 1.7.2 | 1.7.2.1 | 1.7.2.2 | 1.7.2.3 | 1.7.2.4 | 1.7.2.5 | 1.7.3 | 1.7.3.1 | 1.7.3.2 | 0.99.9j | 0.99.9k | 0.99.9l | 0.99.9m | 0.99.9n | 1.0.0 | 1.0.0b | 1.0.3 | 1.0.4 | 1.0.5 | 1.0.6 | 1.0.7 | 1.0.8 | 1.1.0 | 1.1.1 | 1.1.2 | 1.1.3 | 1.1.4 | 1.1.5 | 1.1.6 | 1.2.0 | 1.2.1 | 1.2.2 | 1.2.3 | 1.2.4 | 1.2.5 | 1.2.6 | 1.3.0 | 1.3.1 | 1.3.2 | 1.3.3 | 1.4.0 | 1.4.1 | 1.4.1.1 | 1.4.2 | 1.4.2.1 | 1.4.2.2 | 1.4.2.3 | 1.4.2.4 | 1.4.3 | 1.4.3.1 | 1.4.3.2 | 1.4.3.3 | 1.4.3.4 | 1.4.3.5 | 1.4.4 | 1.4.4.1 | 1.4.4.2 | 1.4.4.3 | 1.4.4.4 | 1.4.4.5 | 1.5.0 | 1.5.0:rc2 | 1.5.0:rc3 | 1.5.0:rc4 | 1.5.0.1 | 1.5.0.2 | 1.5.0.3 | 1.5.0.4 | 1.5.0.5 | 1.5.0.6 | 1.5.0.7 | 1.5.1 | 1.5.1.1 | 1.5.1.2 | 1.5.1.3 | 1.5.1.4 | 1.5.1.5 | 1.5.1.6 | 1.5.2 | 1.5.2.1 | 1.5.2.2 | 1.5.2.3 | 1.5.2.4 | 1.5.2.5 | 1.5.3 | 1.5.3:rc4 | 1.5.3:rc5 | 1.5.3:rc7 | 1.5.3.1 | 1.5.3.2 | 1.5.3.3 | 1.5.3.4 | 1.5.3.5 | 1.5.3.6 | 1.5.3.7 | 1.5.3.8 | 1.5.4 | 1.5.4:rc0 | 1.5.4:rc1 | 1.5.4:rc1.1136.g2794 | 1.5.4:rc2 | 1.5.4:rc3 | 1.5.4:rc4 | 1.5.4:rc5 | 1.5.4.1 | 1.5.4.2 | 1.5.4.3 | 1.5.4.4 | 1.5.4.5 | 1.5.4.6 | 1.5.4.7 | 1.5.5 | 1.5.5:rc1 | 1.5.5:rc2 | 1.5.5:rc3 | 1.5.5.1 | 1.5.5.2 | 1.5.5.3 | 1.5.5.3:r1 | 1.5.5.4 | 1.5.5.5 | 1.5.5.6 | 1.5.6 | 1.5.6.1 | 1.5.6.2 | 1.5.6.3 | 1.5.6.4 | 1.5.6.5 | 1.5.6.6 | 1.5.6.6:rc0 | 1.5.6.6:rc2 | 1.5.6.6:rc3 | 1.6.0 | 1.6.0:rc1 | 1.6.0:rc2 | 1.6.0:rc3 | 1.6.0.1 | 1.6.0.2

Git-scm1 product