Roundup Cross-site scripting (XSS) vulnerability

MEDIUM 4.3CVE-2012-6131 · GHSA-gw2q-cgvq-9g3v · PYSEC-2014-16 · Published 11/04/2014 · updated 16/06/2026

In short

CVE-2012-6131 is a MEDIUM (CVSS 4.3) vulnerability affecting roundup, roundup (roundup-tracker).
Chance of exploitation in the next 30 days (EPSS): 2.0%, higher than 80.8% of all vulnerabilities.
Fix: update to 1.4.20 or later.

Package	Affected versions	Patched versions
roundup PyPI	`< 1.4.20`	`1.4.20`
roundup roundup-tracker	`= 1.4.0= 1.4.1= 1.4.10= 1.4.11= 1.4.12= 1.4.13= 1.4.14= 1.4.15= 1.4.16= 1.4.17= 1.4.18= 1.4.2= 1.4.3= 1.4.4= 1.4.5= 1.4.6= 1.4.7= 1.4.8= 1.4.9≤ 1.4.19`	No fix yet

Description

Cross-site Scripting (XSS) vulnerability in cgi/client.py in Roundup before 1.4.20 allows remote attackers to inject arbitrary web script or HTML via the @action parameter to support/issue1.

NVD description

Cross-site scripting (XSS) vulnerability in cgi/client.py in Roundup before 1.4.20 allows remote attackers to inject arbitrary web script or HTML via the @action parameter to support/issue1.

References

nvd.nist.gov/vuln/detail/CVE-2012-6131 · ADVISORY
roundup-tracker/roundup commit 38193cc · WEB
roundup-tracker/roundup commit ea29de3 · WEB
bugzilla.redhat.com/show_bug.cgi · WEB
exchange.xforce.ibmcloud.com/vulnerabilities/84190 · WEB
pypa/advisory-database · WEB
roundup-tracker/roundup · PACKAGE
pypi.python.org/pypi/roundup/1.4.20 · WEB
issues.roundup-tracker.org/issue2550711 · WEB
openwall.com/lists/oss-security/2012/11/10/2 · WEB
openwall.com/lists/oss-security/2013/02/13/8 · WEB
GitHub Advisory GHSA-gw2q-cgvq-9g3v

More vulnerabilities in roundup

See all →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free

Package

Affected versions

Patched versions

roundup

PyPI

< 1.4.20

1.4.20