Vulnerability record · CVE-2002-0771 · published 12 August 2002

CVE-2002-0771: Viewcvs vulnerability

VViewcvs · Viewcvs

Cross-site scripting vulnerability in viewcvs.cgi for ViewCVS 0.9.2 allows remote attackers to inject script and steal cookies via the (1) cvsroot or (2) sortby parameters.

6.4 CVSS 2.0 Medium EPSS 7.2% · top 5.9%

6.4CVSS 2.0 base score

7.2%EPSS exploitation probability, 30 days

NoNot in CISA KEV

1Affected product versions listed by NVD

6References, 2 tagged exploit

16 Jun 2026Last modified by NVD

Description

Cross-site scripting vulnerability in viewcvs.cgi for ViewCVS 0.9.2 allows remote attackers to inject script and steal cookies via the (1) cvsroot or (2) sortby parameters.

AV:N/AC:L/Au:N/C:P/I:P/A:N

Affected products

1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

VViewcvs Viewcvs

References

Link	Tags
http://archives.neohapsis.com/archives/bugtraq/2002-05/0161.html	PatchVendor Advisory
http://www.iss.net/security_center/static/9112.php	PatchVendor Advisory
http://www.securityfocus.com/bid/4818	ExploitPatchVendor Advisory
http://archives.neohapsis.com/archives/bugtraq/2002-05/0161.html	PatchVendor Advisory
http://www.iss.net/security_center/static/9112.php	PatchVendor Advisory
http://www.securityfocus.com/bid/4818	ExploitPatchVendor Advisory

Track CVE-2002-0771 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

7.6CVE-2005-4830Viewcvs vulnerabilityCRLF injection vulnerability in viewcvs in ViewCVS 0.9.2 allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting…EPSS 2.1%31 Dec 2005 5.0CVE-2004-0915Viewcvs vulnerabilityMultiple unknown vulnerabilities in viewcvs before 0.9.2, when exporting a repository as a tar archive, does not properly implement the hide_cvsroot …EPSS 1.3%10 Jan 2005 4.3CVE-2005-4831Viewcvs vulnerabilityviewcvs in ViewCVS 0.9.2 allows remote attackers to set the Content-Type header to arbitrary values via the content-type parameter, which can be leve…EPSS 1.1%31 Dec 2005 4.3CVE-2004-1062Viewcvs vulnerabilityMultiple cross-site scripting (XSS) vulnerabilities in ViewCVS 0.9.2 allow remote attackers to inject arbitrary HTML and web script via certain error…EPSS 1.2%28 Dec 2004

Source: NIST National Vulnerability Database (record CVE-2002-0771), CISA KEV, FIRST EPSS (scores of 2026-09-26). This page is refreshed as NVD updates the record.