Medium
Security advisory
In Eclipse BIRT versions 1.0 to 4.7, the Report Viewer allows Reflected XSS in URL parameter. Attacker can execute the payload in victim's browser context.
- Products
- Not specified
- Affected versions
- Not specified
- Fixed versions
- Not specified
- CVEs
- CVE-2019-11776
- Confirmed fixed CVEs
- Not specified
- Updated in this feed
- 1 Nov 2026, 06:51 UTC · Revision 1
Source evidence
In Eclipse BIRT versions 1.0 to 4.7, the Report Viewer allows Reflected XSS in URL parameter. Attacker can execute the payload in victim's browser context.
osv:CVE-2019-11776
Complete source record
{
"id": "099beb050a9e9dec01c81771242946dd182ec91b97c6e32ca13743856451f240",
"url": "https://osv.dev/vulnerability/CVE-2019-11776",
"method": "structured",
"payload": {
"kind": "advisory",
"title": "CVE-2019-11776",
"summary": "In Eclipse BIRT versions 1.0 to 4.7, the Report Viewer allows Reflected XSS in URL parameter. Attacker can execute the payload in victim's browser context.",
"evidence": "osv:CVE-2019-11776",
"products": [],
"severity": "medium",
"structured": {
"id": "CVE-2019-11776",
"aliases": [
"CVE-2019-11776"
],
"metrics": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
}
],
"affected": [
{
"ranges": [
{
"repo": "https://github.com/eclipse-birt/birt",
"type": "GIT",
"events": [
{
"introduced": "0"
},
{
"last_affected": "909d8fc3bc76a6787b1d0b4a2c5dfb578950a875"
}
],
"database_specific": {
"extracted_events": [
{
"cpe": "cpe:2.3:a:eclipse:business_intelligence_and_reporting_tools:*:*:*:*:*:*:*:*",
"range": [
{
"introduced": "1.0.0"
},
{
"last_affected": "4.7.0"
}
],
"source": "CPE_RANGE"
}
]
}
}
],
"versions": [
"BIRT_4_7_0_Release_201706222054",
"BIRT_4_6_0_Release_201606072112",
"BIRT_4_5_1_Release_201506092134",
"BIRT_4_5_0_Release_201506092134",
"BIRT_4_5_0_RC4_201506092134",
"v201505061401",
"v201505061331",
"v201505051415",
"v201505050958",
"v201504271033",
"v201504240905",
"v201504231733",
"v201504141336",
"v201502091702",
"v201502041715",
"v201501221215",
"v201501081716",
"v201501061718",
"v201412171534",
"v201412171515",
"v201412161714",
"v201412161149",
"v201412151637",
"v201412081440",
"v201412081016",
"v201411211514",
"v201411181634",
"v201411181632",
"v201411141524",
"v201411141525",
"v201411141154",
"v201411071655",
"v201411071527",
"v201411061701",
"v201411051741",
"BIRT_4_4_0_Release_201406111043",
"BIRT_4_4_0_RC2_201405281057",
"v201405191524",
"BIRT_4_4_0_RC1_201405211030",
"v201405161656",
"v201403111256",
"v201403101018",
"v201403101002",
"v201403071303",
"BIRT_4_3_2_Release_201402191316",
"v201402232139",
"v201402141300",
"v20140211-1400",
"v201310240236",
"v201309222030",
"BIRT_4_3_1_Release_201309181142",
"v201309171028",
"v201309161141",
"v201309131458",
"BIRT_4_3_1_RC3_201309092207",
"v201309091742",
"v201309081955",
"BIRT_4_3_1_RC2_201309031312",
"v201309031242",
"v201309031220",
"v201309021722",
"v201309021618",
"v201308301349",
"BIRT_4_3_0_Release_201306131152",
"v201306031803",
"v201306031409",
"v201305311832",
"v201110281843",
"v201305291555",
"v201305291155",
"v201305290957",
"v201305241042",
"v201305221129",
"v200705101451",
"v201304031124",
"v201304091549",
"v201303281546",
"v201303271507",
"v201303270223",
"v201303121119",
"v201303111125",
"v201303041525",
"v201302281614",
"v201302221451",
"v201301221637",
"v201301211803",
"v201301181657",
"v201301161710",
"v201301161630",
"v201301151658",
"v201301151528",
"v201301141601",
"v201301101706",
"v201301091129",
"v201301091119",
"v201301071801",
"v201301051556",
"v201301041534",
"v201301041109",
"v201212271608",
"v201212241449",
"v201212211615",
"v201212201125",
"v201212191626",
"v201212171552",
"v201212131704",
"v201212061546",
"v201212061403",
"v201211261349",
"v201211211442",
"v201211201109",
"v201211121517",
"v201211070211",
"v201210311502",
"v201209121213",
"v201209121206",
"v201209121203",
"v201209121047",
"v201209111701",
"v201209111026",
"v201209101712",
"v201209101614",
"v201209101448",
"v201209101219",
"v201209081329",
"v201209071804",
"v201209061119",
"v201209061114",
"v201209060743",
"v201209060505",
"v201209041636",
"v201208301143",
"v201208291607",
"v201208291456",
"v201208231223",
"v201208211204",
"v20120213",
"BIRT_3_7_2_Release_201202141408",
"v20120117",
"BIRT_3_7_2_RC1_201201171144",
"v20110905",
"BIRT_3_7_1_Release_201109131734",
"BIRT_3_7_1_RC3_201109051820",
"BIRT_3_7_1_RC2_201108292127",
"v20110815",
"BIRT_3_7_1_RC1_201108161621",
"v20110803",
"BIRT_2_0_Release_20060123"
],
"database_specific": {
"source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2019-11776.json"
}
}
],
"modified": "2026-10-24T10:30:45.520017710Z",
"provider": "osv",
"references": [
"https://bugs.eclipse.org/bugs/show_bug.cgi?id=546816"
],
"provider_metadata": {}
},
"related_cves": [
{
"value": "CVE-2019-11776",
"evidence": "/id"
}
],
"security_relevant": true,
"severity_evidence": "/severity/0/score"
},
"source_id": "core-osv",
"document_id": 436129,
"published_at": "2019-08-09T19:15:11.063+00:00"
}