CVE:CVE-2016-1000037
CNNVD:CNNVD-201911-337
Pagure是一款使用Python编写的提供Web服务的Git仓库。
Pagure中的文件附件端点存在跨站脚本漏洞。该漏洞源于WEB应用缺少对客户端数据的正确验证。攻击者可利用该漏洞执行客户端代码。
solution:Upgrade redhat pagure to a higher version than 2.3.4,and avoid the version (,2.3.4); Upgrade fedoraproject fedora to a higher version than 24,and avoid the version 24; Upgrade redhat enterprise_linux to a higher version than 7.0,and avoid the version 7.0