CVE-2014-6189

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2014-6189
Cross-site scripting (XSS) vulnerability in IBM Security Network Protection 3100, 4100, 5100, and 7100 devices with firmware 5.2 before 5.2.0.0-ISS-XGS-All-Models-Hotfix-FP0008 and 5.3 before 5.3.0.5 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.

6.1 /10

CVSS v3 : MEDIUM

V3 Legend

Vector : AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Exploitability : 2.8 / Impact : 2.7

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction REQUIRED

Confidentiality Impact LOW

Integrity Impact LOW

Availability Impact NONE

Scope CHANGED

4.3 /10

CVSS v2.0 : MEDIUM

V2 Legend

Vector : AV:N/AC:M/Au:N/C:N/I:P/A:N

Exploitability : 8.6 / Impact : 2.9

Access Vector NETWORK

Access Complexity MEDIUM

Authentication NONE

Confidentiality Impact NONE

Integrity Impact PARTIAL

Availability Impact NONE

References
Link Resource
http://www-01.ibm.com/support/docview.wss?uid=swg21697248 Vendor Advisory
http://www.securityfocus.com/bid/73940 Third Party Advisory VDB Entry
Configurations

Configuration 1 (hide)

AND
OR cpe:2.3:o:ibm:security_network_protection_4100_firmware:5.2:*:*:*:*:*:*:*
cpe:2.3:o:ibm:security_network_protection_4100_firmware:5.3:*:*:*:*:*:*:*
cpe:2.3:h:ibm:security_network_protection_4100:-:*:*:*:*:*:*:*

Configuration 2 (hide)

AND
OR cpe:2.3:o:ibm:security_network_protection_3100_firmware:5.2:*:*:*:*:*:*:*
cpe:2.3:o:ibm:security_network_protection_3100_firmware:5.3:*:*:*:*:*:*:*
cpe:2.3:h:ibm:security_network_protection_3100:-:*:*:*:*:*:*:*

Configuration 3 (hide)

AND
OR cpe:2.3:o:ibm:security_network_protection_5100_firmware:5.2:*:*:*:*:*:*:*
cpe:2.3:o:ibm:security_network_protection_5100_firmware:5.3:*:*:*:*:*:*:*
cpe:2.3:h:ibm:security_network_protection_5100:-:*:*:*:*:*:*:*

Configuration 4 (hide)

AND
OR cpe:2.3:o:ibm:security_network_protection_7100_firmware:5.2:*:*:*:*:*:*:*
cpe:2.3:o:ibm:security_network_protection_7100_firmware:5.3:*:*:*:*:*:*:*
cpe:2.3:h:ibm:security_network_protection_7100:-:*:*:*:*:*:*:*
History

No history.

Information

Published : 2017-08-22 15:29

Updated : 2024-02-04 19:29

NVD link : CVE-2014-6189

Mitre link : CVE-2014-6189

CVE.ORG link : CVE-2014-6189

JSON object : View

Products Affected

ibm

  • security_network_protection_5100_firmware
  • security_network_protection_4100
  • security_network_protection_4100_firmware
  • security_network_protection_7100
  • security_network_protection_3100_firmware
  • security_network_protection_5100
  • security_network_protection_3100
  • security_network_protection_7100_firmware
CWE
CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')