CVE-2014-1403

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2014-1403
Cross-site scripting (XSS) vulnerability in name.html in easyXDM before 2.4.19 allows remote attackers to inject arbitrary web script or HTML via the location.hash value.

4.3 /10

CVSS v2.0 : MEDIUM

V2 Legend

Vector : AV:N/AC:M/Au:N/C:N/I:P/A:N

Exploitability : 8.6 / Impact : 2.9

Access Vector NETWORK

Access Complexity MEDIUM

Authentication NONE

Confidentiality Impact NONE

Integrity Impact PARTIAL

Availability Impact NONE

References
Link Resource
http://blog.kotowicz.net/2014/01/xssing-with-shakespeare-name-calling.html Exploit
http://osvdb.org/102803
http://seclists.org/fulldisclosure/2014/Feb/5 Exploit
http://secunia.com/advisories/56634 Vendor Advisory
http://www.securityfocus.com/bid/65291
https://exchange.xforce.ibmcloud.com/vulnerabilities/90876
https://github.com/oyvindkinsey/easyXDM/commit/a3194d32c25a0d27a10a47304eb9c9be93ffbf13#diff-6489956f1e1f52236929b4d33cbeb2db Exploit Patch
https://github.com/oyvindkinsey/easyXDM/releases/tag/2.4.19 Patch Vendor Advisory
http://blog.kotowicz.net/2014/01/xssing-with-shakespeare-name-calling.html Exploit
http://osvdb.org/102803
http://seclists.org/fulldisclosure/2014/Feb/5 Exploit
http://secunia.com/advisories/56634 Vendor Advisory
http://www.securityfocus.com/bid/65291
https://exchange.xforce.ibmcloud.com/vulnerabilities/90876
https://github.com/oyvindkinsey/easyXDM/commit/a3194d32c25a0d27a10a47304eb9c9be93ffbf13#diff-6489956f1e1f52236929b4d33cbeb2db Exploit Patch
https://github.com/oyvindkinsey/easyXDM/releases/tag/2.4.19 Patch Vendor Advisory
Configurations

Configuration 1 (hide)

OR cpe:2.3:a:easyxdm:easyxdm:*:*:*:*:*:*:*:*
cpe:2.3:a:easyxdm:easyxdm:2.3.2:*:*:*:*:*:*:*
cpe:2.3:a:easyxdm:easyxdm:2.3.3:*:*:*:*:*:*:*
cpe:2.3:a:easyxdm:easyxdm:2.4.0:*:*:*:*:*:*:*
cpe:2.3:a:easyxdm:easyxdm:2.4.1:*:*:*:*:*:*:*
cpe:2.3:a:easyxdm:easyxdm:2.4.2:*:*:*:*:*:*:*
cpe:2.3:a:easyxdm:easyxdm:2.4.3:*:*:*:*:*:*:*
cpe:2.3:a:easyxdm:easyxdm:2.4.4:*:*:*:*:*:*:*
cpe:2.3:a:easyxdm:easyxdm:2.4.5:*:*:*:*:*:*:*
cpe:2.3:a:easyxdm:easyxdm:2.4.6:*:*:*:*:*:*:*
History

21 Nov 2024, 02:04

Type Values Removed Values Added
References () http://blog.kotowicz.net/2014/01/xssing-with-shakespeare-name-calling.html - Exploit () http://blog.kotowicz.net/2014/01/xssing-with-shakespeare-name-calling.html - Exploit
References () http://osvdb.org/102803 - () http://osvdb.org/102803 -
References () http://seclists.org/fulldisclosure/2014/Feb/5 - Exploit () http://seclists.org/fulldisclosure/2014/Feb/5 - Exploit
References () http://secunia.com/advisories/56634 - Vendor Advisory () http://secunia.com/advisories/56634 - Vendor Advisory
References () http://www.securityfocus.com/bid/65291 - () http://www.securityfocus.com/bid/65291 -
References () https://exchange.xforce.ibmcloud.com/vulnerabilities/90876 - () https://exchange.xforce.ibmcloud.com/vulnerabilities/90876 -
References () https://github.com/oyvindkinsey/easyXDM/commit/a3194d32c25a0d27a10a47304eb9c9be93ffbf13#diff-6489956f1e1f52236929b4d33cbeb2db - Exploit, Patch () https://github.com/oyvindkinsey/easyXDM/commit/a3194d32c25a0d27a10a47304eb9c9be93ffbf13#diff-6489956f1e1f52236929b4d33cbeb2db - Exploit, Patch
References () https://github.com/oyvindkinsey/easyXDM/releases/tag/2.4.19 - Patch, Vendor Advisory () https://github.com/oyvindkinsey/easyXDM/releases/tag/2.4.19 - Patch, Vendor Advisory
Information

Published : 2014-02-05 15:10

Updated : 2024-11-21 02:04

NVD link : CVE-2014-1403

Mitre link : CVE-2014-1403

CVE.ORG link : CVE-2014-1403

JSON object : View

Products Affected

easyxdm

  • easyxdm
CWE
CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')