VYPR
← All advisories
Moderate severityNVD Advisory· Published Aug 25, 2009· Updated Apr 23, 2026

CVE-2009-2959

CVE-2009-2959

Description

Cross-site scripting (XSS) vulnerability in the waterfall web status view (status/web/waterfall.py) in Buildbot 0.7.6 through 0.7.11p1 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.

Affected packages

Versions sourced from the GitHub Security Advisory.

PackageAffected versionsPatched versions
buildbotPyPI
>= 0.7.6, < 0.7.11p30.7.11p3

Affected products

8
  • Buildbot/Buildbot8 versions
    cpe:2.3:a:buildbot:buildbot:0.7.10:*:*:*:*:*:*:*+ 7 more
    • cpe:2.3:a:buildbot:buildbot:0.7.10:*:*:*:*:*:*:*
    • cpe:2.3:a:buildbot:buildbot:0.7.10p1:*:*:*:*:*:*:*
    • cpe:2.3:a:buildbot:buildbot:0.7.11:*:*:*:*:*:*:*
    • cpe:2.3:a:buildbot:buildbot:0.7.11p1:*:*:*:*:*:*:*
    • cpe:2.3:a:buildbot:buildbot:0.7.6:*:*:*:*:*:*:*
    • cpe:2.3:a:buildbot:buildbot:0.7.7:*:*:*:*:*:*:*
    • cpe:2.3:a:buildbot:buildbot:0.7.8:*:*:*:*:*:*:*
    • cpe:2.3:a:buildbot:buildbot:0.7.9:*:*:*:*:*:*:*

Patches

1
a08ee48e796a

Fix XSS in waterfall help.

https://github.com/buildbot/buildbotNicolás AlvarezAug 13, 2009via ghsa
commit
1 file changed · +1 −1
  • buildbot/status/web/waterfall.py+1 −1 modified
    @@ -399,7 +399,7 @@ def body(self, request):
                                   '<td><input type="radio" name="reload" '
                                   'value="%s" %s></td> '
                                   '<td>%s</td></tr>\n'
-                                  ) % (value, checked, name)
+                                  ) % (html.escape(value), checked, html.escape(name))
         show_reload_input += '</table>\n'
 
         fields = {"show_events_input": show_events_input,

Vulnerability mechanics

Generated by null/stub on May 9, 2026. Inputs: CWE entries + fix-commit diffs from this CVE's patches. Citations validated against bundle.

References

16

News mentions

0

No linked articles in our index yet.