CVE-2005-4831: viewcvs in ViewCVS 0.9.2 allows remote attackers to set the Content-Type header to arbitrary values via the...

Security readout for executives and security teams

This CVE affects old ViewCVS deployments where a web request can influence the response Content-Type header. That can make a browser treat repository content as executable web content, enabling cross-site scripting in some conditions. The sources do not provide CVSS, confirmed patch status, or active exploitation evidence. Exposure is likely limited to internet-facing or intranet ViewCVS 0.9.2 installations, with possible exposure for 0.9.4. Organizations using modern repository browsers are unlikely affected unless legacy ViewCVS remains deployed. Treat this as a legacy web application risk. It is not KEV-listed and lacks a published severity score, but exposed ViewCVS instances should be prioritized for inventory, access restriction, and replacement or vendor-confirmed remediation. Mitigation focus: Inventory public and internal ViewCVS deployments and identify exact versions.; Check original vendor or maintainer guidance for fixed versions or recommended configuration changes.; Restrict access to affected ViewCVS instances until remediation is confirmed..

Prepared

Jun 29, 2026, 07:07 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.