VYPR
Get started
← All advisories
Moderate severityNVD Advisory· Published Sep 24, 2010· Updated Apr 29, 2026

CVE-2010-2491

CVE-2010-2491

Description

Cross-site scripting (XSS) vulnerability in cgi/client.py in Roundup before 1.4.14 allows remote attackers to inject arbitrary web script or HTML via the template argument to the /issue program.

Affected packages

Versions sourced from the GitHub Security Advisory.

PackageAffected versionsPatched versions
roundupPyPI
< 1.4.141.4.14

Affected products

104
  • Roundup Tracker/Roundup104 versions
    cpe:2.3:a:roundup-tracker:roundup:*:*:*:*:*:*:*:*+ 103 more
    • cpe:2.3:a:roundup-tracker:roundup:*:*:*:*:*:*:*:*range: <=1.4.13
    • cpe:2.3:a:roundup-tracker:roundup:0.1.0:*:*:*:*:*:*:*
    • cpe:2.3:a:roundup-tracker:roundup:0.1.1:*:*:*:*:*:*:*
    • cpe:2.3:a:roundup-tracker:roundup:0.1.2:*:*:*:*:*:*:*
    • cpe:2.3:a:roundup-tracker:roundup:0.1.3:*:*:*:*:*:*:*
    • cpe:2.3:a:roundup-tracker:roundup:0.2.0:*:*:*:*:*:*:*
    • cpe:2.3:a:roundup-tracker:roundup:0.2.1:*:*:*:*:*:*:*
    • cpe:2.3:a:roundup-tracker:roundup:0.2.2:*:*:*:*:*:*:*
    • cpe:2.3:a:roundup-tracker:roundup:0.2.3:*:*:*:*:*:*:*
    • cpe:2.3:a:roundup-tracker:roundup:0.2.4:*:*:*:*:*:*:*
    • cpe:2.3:a:roundup-tracker:roundup:0.2.5:*:*:*:*:*:*:*
    • cpe:2.3:a:roundup-tracker:roundup:0.2.6:*:*:*:*:*:*:*
    • cpe:2.3:a:roundup-tracker:roundup:0.2.7:*:*:*:*:*:*:*
    • cpe:2.3:a:roundup-tracker:roundup:0.2.8:*:*:*:*:*:*:*
    • cpe:2.3:a:roundup-tracker:roundup:0.3.0:*:*:*:*:*:*:*
    • cpe:2.3:a:roundup-tracker:roundup:0.3.0:pre1:*:*:*:*:*:*
    • cpe:2.3:a:roundup-tracker:roundup:0.3.0:pre2:*:*:*:*:*:*
    • cpe:2.3:a:roundup-tracker:roundup:0.3.0:pre3:*:*:*:*:*:*
    • cpe:2.3:a:roundup-tracker:roundup:0.4.0:*:*:*:*:*:*:*
    • cpe:2.3:a:roundup-tracker:roundup:0.4.0:b1:*:*:*:*:*:*
    • cpe:2.3:a:roundup-tracker:roundup:0.4.0:b2:*:*:*:*:*:*
    • cpe:2.3:a:roundup-tracker:roundup:0.4.1:*:*:*:*:*:*:*
    • cpe:2.3:a:roundup-tracker:roundup:0.4.2:*:*:*:*:*:*:*
    • cpe:2.3:a:roundup-tracker:roundup:0.4.2:pr1:*:*:*:*:*:*
    • cpe:2.3:a:roundup-tracker:roundup:0.5:*:*:*:*:*:*:*
    • cpe:2.3:a:roundup-tracker:roundup:0.5.0:*:*:*:*:*:*:*
    • cpe:2.3:a:roundup-tracker:roundup:0.5.0:beta1:*:*:*:*:*:*
    • cpe:2.3:a:roundup-tracker:roundup:0.5.0:beta2:*:*:*:*:*:*
    • cpe:2.3:a:roundup-tracker:roundup:0.5.0:pr1:*:*:*:*:*:*
    • cpe:2.3:a:roundup-tracker:roundup:0.5.1:*:*:*:*:*:*:*
    • cpe:2.3:a:roundup-tracker:roundup:0.5.2:*:*:*:*:*:*:*
    • cpe:2.3:a:roundup-tracker:roundup:0.5.3:*:*:*:*:*:*:*
    • cpe:2.3:a:roundup-tracker:roundup:0.5.4:*:*:*:*:*:*:*
    • cpe:2.3:a:roundup-tracker:roundup:0.5.5:*:*:*:*:*:*:*
    • cpe:2.3:a:roundup-tracker:roundup:0.5.6:*:*:*:*:*:*:*
    • cpe:2.3:a:roundup-tracker:roundup:0.5.7:*:*:*:*:*:*:*
    • cpe:2.3:a:roundup-tracker:roundup:0.5.8:stable:*:*:*:*:*:*
    • cpe:2.3:a:roundup-tracker:roundup:0.5.9:*:*:*:*:*:*:*
    • cpe:2.3:a:roundup-tracker:roundup:0.6.0:*:*:*:*:*:*:*
    • cpe:2.3:a:roundup-tracker:roundup:0.6.0:b1:*:*:*:*:*:*
    • cpe:2.3:a:roundup-tracker:roundup:0.6.0:b2:*:*:*:*:*:*
    • cpe:2.3:a:roundup-tracker:roundup:0.6.0:b3:*:*:*:*:*:*
    • cpe:2.3:a:roundup-tracker:roundup:0.6.0:b4:*:*:*:*:*:*
    • cpe:2.3:a:roundup-tracker:roundup:0.6.1:*:*:*:*:*:*:*
    • cpe:2.3:a:roundup-tracker:roundup:0.6.10:*:*:*:*:*:*:*
    • cpe:2.3:a:roundup-tracker:roundup:0.6.11:*:*:*:*:*:*:*
    • cpe:2.3:a:roundup-tracker:roundup:0.6.2:*:*:*:*:*:*:*
    • cpe:2.3:a:roundup-tracker:roundup:0.6.3:*:*:*:*:*:*:*
    • cpe:2.3:a:roundup-tracker:roundup:0.6.4:*:*:*:*:*:*:*
    • cpe:2.3:a:roundup-tracker:roundup:0.6.5:*:*:*:*:*:*:*
    • cpe:2.3:a:roundup-tracker:roundup:0.6.6:*:*:*:*:*:*:*
    • cpe:2.3:a:roundup-tracker:roundup:0.6.7:*:*:*:*:*:*:*
    • cpe:2.3:a:roundup-tracker:roundup:0.6.8:*:*:*:*:*:*:*
    • cpe:2.3:a:roundup-tracker:roundup:0.6.9:*:*:*:*:*:*:*
    • cpe:2.3:a:roundup-tracker:roundup:0.7.0:*:*:*:*:*:*:*
    • cpe:2.3:a:roundup-tracker:roundup:0.7.0:b1:*:*:*:*:*:*
    • cpe:2.3:a:roundup-tracker:roundup:0.7.0:b2:*:*:*:*:*:*
    • cpe:2.3:a:roundup-tracker:roundup:0.7.0:b3:*:*:*:*:*:*
    • cpe:2.3:a:roundup-tracker:roundup:0.7.1:*:*:*:*:*:*:*
    • cpe:2.3:a:roundup-tracker:roundup:0.7.10:*:*:*:*:*:*:*
    • cpe:2.3:a:roundup-tracker:roundup:0.7.11:*:*:*:*:*:*:*
    • cpe:2.3:a:roundup-tracker:roundup:0.7.12:*:*:*:*:*:*:*
    • cpe:2.3:a:roundup-tracker:roundup:0.7.2:*:*:*:*:*:*:*
    • cpe:2.3:a:roundup-tracker:roundup:0.7.3:*:*:*:*:*:*:*
    • cpe:2.3:a:roundup-tracker:roundup:0.7.4:*:*:*:*:*:*:*
    • cpe:2.3:a:roundup-tracker:roundup:0.7.5:*:*:*:*:*:*:*
    • cpe:2.3:a:roundup-tracker:roundup:0.7.6:*:*:*:*:*:*:*
    • cpe:2.3:a:roundup-tracker:roundup:0.7.7:*:*:*:*:*:*:*
    • cpe:2.3:a:roundup-tracker:roundup:0.7.8:*:*:*:*:*:*:*
    • cpe:2.3:a:roundup-tracker:roundup:0.7.9:*:*:*:*:*:*:*
    • cpe:2.3:a:roundup-tracker:roundup:0.8.0:*:*:*:*:*:*:*
    • cpe:2.3:a:roundup-tracker:roundup:0.8.0:b1:*:*:*:*:*:*
    • cpe:2.3:a:roundup-tracker:roundup:0.8.0:b2:*:*:*:*:*:*
    • cpe:2.3:a:roundup-tracker:roundup:0.8.1:*:*:*:*:*:*:*
    • cpe:2.3:a:roundup-tracker:roundup:0.8.2:*:*:*:*:*:*:*
    • cpe:2.3:a:roundup-tracker:roundup:0.8.3:*:*:*:*:*:*:*
    • cpe:2.3:a:roundup-tracker:roundup:0.8.4:*:*:*:*:*:*:*
    • cpe:2.3:a:roundup-tracker:roundup:0.8.5:*:*:*:*:*:*:*
    • cpe:2.3:a:roundup-tracker:roundup:0.8.6:*:*:*:*:*:*:*
    • cpe:2.3:a:roundup-tracker:roundup:0.9.0:b1:*:*:*:*:*:*
    • cpe:2.3:a:roundup-tracker:roundup:1.0:*:*:*:*:*:*:*
    • cpe:2.3:a:roundup-tracker:roundup:1.0.1:*:*:*:*:*:*:*
    • cpe:2.3:a:roundup-tracker:roundup:1.1.0:*:*:*:*:*:*:*
    • cpe:2.3:a:roundup-tracker:roundup:1.1.1:*:*:*:*:*:*:*
    • cpe:2.3:a:roundup-tracker:roundup:1.1.2:*:*:*:*:*:*:*
    • cpe:2.3:a:roundup-tracker:roundup:1.2.0:*:*:*:*:*:*:*
    • cpe:2.3:a:roundup-tracker:roundup:1.2.1:*:*:*:*:*:*:*
    • cpe:2.3:a:roundup-tracker:roundup:1.3.0:*:*:*:*:*:*:*
    • cpe:2.3:a:roundup-tracker:roundup:1.3.1:*:*:*:*:*:*:*
    • cpe:2.3:a:roundup-tracker:roundup:1.3.2:*:*:*:*:*:*:*
    • cpe:2.3:a:roundup-tracker:roundup:1.3.3:*:*:*:*:*:*:*
    • cpe:2.3:a:roundup-tracker:roundup:1.4.0:*:*:*:*:*:*:*
    • cpe:2.3:a:roundup-tracker:roundup:1.4.1:*:*:*:*:*:*:*
    • cpe:2.3:a:roundup-tracker:roundup:1.4.10:*:*:*:*:*:*:*
    • cpe:2.3:a:roundup-tracker:roundup:1.4.11:*:*:*:*:*:*:*
    • cpe:2.3:a:roundup-tracker:roundup:1.4.12:*:*:*:*:*:*:*
    • cpe:2.3:a:roundup-tracker:roundup:1.4.2:*:*:*:*:*:*:*
    • cpe:2.3:a:roundup-tracker:roundup:1.4.3:*:*:*:*:*:*:*
    • cpe:2.3:a:roundup-tracker:roundup:1.4.4:*:*:*:*:*:*:*
    • cpe:2.3:a:roundup-tracker:roundup:1.4.5:*:*:*:*:*:*:*
    • cpe:2.3:a:roundup-tracker:roundup:1.4.6:*:*:*:*:*:*:*
    • cpe:2.3:a:roundup-tracker:roundup:1.4.7:*:*:*:*:*:*:*
    • cpe:2.3:a:roundup-tracker:roundup:1.4.8:*:*:*:*:*:*:*
    • cpe:2.3:a:roundup-tracker:roundup:1.4.9:*:*:*:*:*:*:*

Patches

1
dcef024bae8f

fix potential XSS hole

https://github.com/roundup-tracker/roundupRichard JonesJul 1, 2010via ghsa
commit
2 files changed · +4 −4
  • roundup/cgi/client.py+2 −2 modified
    @@ -1069,9 +1069,9 @@ def renderContext(self):
                 result = result.replace('</body>', s)
             return result
         except templating.NoTemplate, message:
-            return '<strong>%s</strong>'%message
+            return '<strong>%s</strong>'%cgi.escape(str(message))
         except templating.Unauthorised, message:
-            raise Unauthorised(str(message))
+            raise Unauthorised(cgi.escape(str(message)))
         except:
             # everything else
             if self.instance.config.WEB_DEBUG:
  • roundup/cgi/templating.py+2 −2 modified
    @@ -115,9 +115,9 @@ def find_template(dir, name, view):
     if os.path.exists(src):
         return (src, generic)
 
-    raise NoTemplate, 'No template file exists for templating "%s" '\
+    raise NoTemplate('No template file exists for templating "%s" '
         'with template "%s" (neither "%s" nor "%s")'%(name, view,
-        filename, generic)
+        filename, generic))
 
 class Templates:
     templates = {}

Vulnerability mechanics

Generated by null/stub on May 9, 2026. Inputs: CWE entries + fix-commit diffs from this CVE's patches. Citations validated against bundle.

References

21

News mentions

0

No linked articles in our index yet.