Not a U.S. government website. NDD is an independent vulnerability database by Volerion and is not affiliated with or endorsed by NIST or NVD.

CVE-2014-3994 Details

Description

Cross-site scripting (XSS) vulnerability in util/templatetags/djblets_js.py in Djblets before 0.7.30 and 0.8.x before 0.8.3 for Django, as used in Review Board, allows remote attackers to inject arbitrary web script or HTML via a JSON object, as demonstrated by the name field when changing a user name.

Metrics

CVSS 3.x Severity and Vector Strings:

No CVSS 3.x data is available for this CVE.

References to Advisories, Solutions, and Tools

By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.

URL	Source(s)	Tag(s)
https://code.google.com/p/reviewboard/issues/detail?id=3406	CVE	Not Applicable
http://seclists.org/oss-sec/2014/q2/494	CVE	Third Party AdvisoryVDB Entry
http://seclists.org/oss-sec/2014/q2/498	CVE	Third Party AdvisoryVDB Entry
http://secunia.com/advisories/58691	CVE	Permissions RequiredThird Party Advisory
https://github.com/djblets/djblets/commit/50000d0bbb983fa8c097b588d06b64df8df483bd	CVE	Issue TrackingPatch
https://github.com/djblets/djblets/commit/77a68c03cd619a0996f3f37337b8c39ca6643d6e	CVE	ExploitIssue TrackingPatch
https://github.com/djblets/djblets/commit/e2c79117efd925636acd871a5f473512602243cf	CVE	Issue TrackingPatch
http://www.securityfocus.com/bid/67932	CVE	Third Party AdvisoryVDB Entry
https://code.google.com/p/reviewboard/issues/detail?id=3406	[email protected]	Not Applicable
http://seclists.org/oss-sec/2014/q2/494	[email protected]	Third Party AdvisoryVDB Entry
http://seclists.org/oss-sec/2014/q2/498	[email protected]	Third Party AdvisoryVDB Entry
http://secunia.com/advisories/58691	[email protected]	Permissions RequiredThird Party Advisory
https://github.com/djblets/djblets/commit/50000d0bbb983fa8c097b588d06b64df8df483bd	[email protected]	Issue TrackingPatch
https://github.com/djblets/djblets/commit/77a68c03cd619a0996f3f37337b8c39ca6643d6e	[email protected]	ExploitIssue TrackingPatch
https://github.com/djblets/djblets/commit/e2c79117efd925636acd871a5f473512602243cf	[email protected]	Issue TrackingPatch
http://www.securityfocus.com/bid/67932	[email protected]	Third Party AdvisoryVDB Entry

see all 16 references

Weakness Enumeration

CWE-ID	CWE Name	Source
CWE-79	Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')	[email protected]

Affected Products

Product	Versions
reviewboard djblets	<= 0.7.29 0.7.27 0.7.28 0.8.1 0.8.2
CPE cpe:2.3:a:reviewboard:djblets:::::::: cpe:2.3:a:reviewboard:djblets:0.7.27:::::::* cpe:2.3:a:reviewboard:djblets:0.7.28:::::::* cpe:2.3:a:reviewboard:djblets:0.8.1:::::::* cpe:2.3:a:reviewboard:djblets:0.8.2:::::::* Remediation No remediation found in references.
reviewboard reviewboard	All versions
CPE cpe:2.3:a:reviewboard:reviewboard:-:::::::* Remediation No remediation found in references.

Change History

7 change records found show changes

Date	Action	Recorded By
Jun 17, 2026	CVE Modified	[email protected]
May 6, 2026	Status Change	[email protected]
Nov 21, 2024	CVE Modified	CVE
May 14, 2024	CVE Modified	[email protected]
Aug 23, 2016	Modified Analysis	[email protected]
Apr 23, 2015	CVE Modified	[email protected]
Jun 17, 2014	Initial Analysis	[email protected]