CVE-2003-0154 json
Cross-site scripting vulnerabilities (XSS) in bonsai Mozilla CVS query tool allow remote attackers to execute arbitrary web script via (1)…
published 2003-03-26 23 y ago modified 2026-06-16 4 mo ago also EUVD-2003-0150
- cvss
- 6.8
- version 2.0, NVD
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 4.6%
- EPSS 4.6% chance of exploitation in 30 days, percentile 91%
- public exploits
- 1
- Exploit-DB
Summary
Cross-site scripting vulnerabilities (XSS) in bonsai Mozilla CVS query tool allow remote attackers to execute arbitrary web script via (1) the file, root, or rev parameters to cvslog.cgi, (2) the file or root parameters to cvsblame.cgi, (3) various parameters to cvsquery.cgi, (4) the person parameter to showcheckins.cgi, (5) the module parameter to cvsqueryform.cgi, and (6) possibly other attack vectors as identified by Mozilla bug #146244.
Patch / fix
- debian.org/security/2003/dsa-265 advisory
- securityfocus.com/bid/5516 advisory
Timeline
- First public exploit (EDB-21729)
- Published
Exploit prediction
4.59% chance of exploitation in the next 30 days, higher than 91% of all scored CVEs (FIRST EPSS, 2026-11-08).
Exploits and checks
- EDB-21729 Mozilla Bonsai - Multiple Cross-Site Scripting Vulnerabilities webapps, 2002-08-20
- securityfocus.com http://www.securityfocus.com/bid/5516 referenced PoC, tagged "exploit" by a source, unverified
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| NVD | 2.0 | 6.8 | AV:N/AC:M/Au:N/C:P/I:P/A:P |
References
-
debian.org
/security/2003/dsa-265
vendor-advisory, patch
-
securityfocus.com
/bid/5516
vdb-entry, exploit, patch, vendor-advisory
- bugzilla.mozilla.org /attachment.cgi?id=95985&action=view
- bugzilla.mozilla.org /attachment.cgi?id=95950&action=view
-
iss.net
/security_center/static/9920.php
vdb-entry
-
marc.info
/?l=bugtraq&m=102980129101054&w=2
mailing-list
- bugzilla.mozilla.org /show_bug.cgi?id=163573
- bugzilla.mozilla.org /show_bug.cgi?id=146244
Sources
- CVE List CVE-2003-0154
- NVD CVE-2003-0154
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.