CVE-2014-8658

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2014-8658
Cross-site scripting (XSS) vulnerability in RefinedWiki Original Theme 3.x before 3.5.13 and 4.x before 4.0.12 for Confluence allows remote authenticated users with permissions to create or edit content to inject arbitrary web script or HTML via the versionComment parameter to pages/doeditpage.action.

4.0 /10

CVSS v2.0 : MEDIUM

V2 Legend

Vector : AV:N/AC:L/Au:S/C:N/I:P/A:N

Exploitability : 8.0 / Impact : 2.9

Access Vector NETWORK

Access Complexity LOW

Authentication SINGLE

Confidentiality Impact NONE

Integrity Impact PARTIAL

Availability Impact NONE

References
Link Resource
http://demo.refinedwiki.com/display/rwot/Version+4.0.12 Vendor Advisory
http://packetstormsecurity.com/files/128907/Confluence-RefinedWiki-Original-Theme-Cross-Site-Scripting.html Exploit
http://seclists.org/fulldisclosure/2014/Oct/126
http://www.securityfocus.com/archive/1/533845/100/0/threaded
http://www.securityfocus.com/bid/70798
https://exchange.xforce.ibmcloud.com/vulnerabilities/98401
https://www.sec-consult.com/fxdata/seccons/prod/temedia/advisories_txt/20141029-1_RefinedWiki-OriginalTheme_Persistent-Cross-Site-Scripting_v10.txt Exploit
http://demo.refinedwiki.com/display/rwot/Version+4.0.12 Vendor Advisory
http://packetstormsecurity.com/files/128907/Confluence-RefinedWiki-Original-Theme-Cross-Site-Scripting.html Exploit
http://seclists.org/fulldisclosure/2014/Oct/126
http://www.securityfocus.com/archive/1/533845/100/0/threaded
http://www.securityfocus.com/bid/70798
https://exchange.xforce.ibmcloud.com/vulnerabilities/98401
https://www.sec-consult.com/fxdata/seccons/prod/temedia/advisories_txt/20141029-1_RefinedWiki-OriginalTheme_Persistent-Cross-Site-Scripting_v10.txt Exploit
Configurations

Configuration 1 (hide)

OR cpe:2.3:a:refinedwiki:refinedwiki_original_theme:3.5:*:*:*:*:confluence:*:*
cpe:2.3:a:refinedwiki:refinedwiki_original_theme:3.5.1:*:*:*:*:confluence:*:*
cpe:2.3:a:refinedwiki:refinedwiki_original_theme:3.5.2:*:*:*:*:confluence:*:*
cpe:2.3:a:refinedwiki:refinedwiki_original_theme:3.5.3:*:*:*:*:confluence:*:*
cpe:2.3:a:refinedwiki:refinedwiki_original_theme:3.5.4:*:*:*:*:confluence:*:*
cpe:2.3:a:refinedwiki:refinedwiki_original_theme:3.5.5:*:*:*:*:confluence:*:*
cpe:2.3:a:refinedwiki:refinedwiki_original_theme:3.5.6:*:*:*:*:confluence:*:*
cpe:2.3:a:refinedwiki:refinedwiki_original_theme:3.5.7:*:*:*:*:confluence:*:*
cpe:2.3:a:refinedwiki:refinedwiki_original_theme:3.5.8:*:*:*:*:confluence:*:*
cpe:2.3:a:refinedwiki:refinedwiki_original_theme:3.5.9:*:*:*:*:confluence:*:*
cpe:2.3:a:refinedwiki:refinedwiki_original_theme:3.5.10:*:*:*:*:confluence:*:*
cpe:2.3:a:refinedwiki:refinedwiki_original_theme:3.5.11:*:*:*:*:confluence:*:*
cpe:2.3:a:refinedwiki:refinedwiki_original_theme:3.5.12:*:*:*:*:confluence:*:*
cpe:2.3:a:refinedwiki:refinedwiki_original_theme:3.5.13:*:*:*:*:confluence:*:*
cpe:2.3:a:refinedwiki:refinedwiki_original_theme:4.0:*:*:*:*:confluence:*:*
cpe:2.3:a:refinedwiki:refinedwiki_original_theme:4.0.1:*:*:*:*:confluence:*:*
cpe:2.3:a:refinedwiki:refinedwiki_original_theme:4.0.2:*:*:*:*:confluence:*:*
cpe:2.3:a:refinedwiki:refinedwiki_original_theme:4.0.3:*:*:*:*:confluence:*:*
cpe:2.3:a:refinedwiki:refinedwiki_original_theme:4.0.4:*:*:*:*:confluence:*:*
cpe:2.3:a:refinedwiki:refinedwiki_original_theme:4.0.5:*:*:*:*:confluence:*:*
cpe:2.3:a:refinedwiki:refinedwiki_original_theme:4.0.6:*:*:*:*:confluence:*:*
cpe:2.3:a:refinedwiki:refinedwiki_original_theme:4.0.7:*:*:*:*:confluence:*:*
cpe:2.3:a:refinedwiki:refinedwiki_original_theme:4.0.8:*:*:*:*:confluence:*:*
cpe:2.3:a:refinedwiki:refinedwiki_original_theme:4.0.9:*:*:*:*:confluence:*:*
cpe:2.3:a:refinedwiki:refinedwiki_original_theme:4.0.10:*:*:*:*:confluence:*:*
cpe:2.3:a:refinedwiki:refinedwiki_original_theme:4.0.11:*:*:*:*:confluence:*:*
History

21 Nov 2024, 02:19

Type Values Removed Values Added
References () http://demo.refinedwiki.com/display/rwot/Version+4.0.12 - Vendor Advisory () http://demo.refinedwiki.com/display/rwot/Version+4.0.12 - Vendor Advisory
References () http://packetstormsecurity.com/files/128907/Confluence-RefinedWiki-Original-Theme-Cross-Site-Scripting.html - Exploit () http://packetstormsecurity.com/files/128907/Confluence-RefinedWiki-Original-Theme-Cross-Site-Scripting.html - Exploit
References () http://seclists.org/fulldisclosure/2014/Oct/126 - () http://seclists.org/fulldisclosure/2014/Oct/126 -
References () http://www.securityfocus.com/archive/1/533845/100/0/threaded - () http://www.securityfocus.com/archive/1/533845/100/0/threaded -
References () http://www.securityfocus.com/bid/70798 - () http://www.securityfocus.com/bid/70798 -
References () https://exchange.xforce.ibmcloud.com/vulnerabilities/98401 - () https://exchange.xforce.ibmcloud.com/vulnerabilities/98401 -
References () https://www.sec-consult.com/fxdata/seccons/prod/temedia/advisories_txt/20141029-1_RefinedWiki-OriginalTheme_Persistent-Cross-Site-Scripting_v10.txt - Exploit () https://www.sec-consult.com/fxdata/seccons/prod/temedia/advisories_txt/20141029-1_RefinedWiki-OriginalTheme_Persistent-Cross-Site-Scripting_v10.txt - Exploit
Information

Published : 2014-11-06 15:55

Updated : 2024-11-21 02:19

NVD link : CVE-2014-8658

Mitre link : CVE-2014-8658

CVE.ORG link : CVE-2014-8658

JSON object : View

Products Affected

refinedwiki

  • refinedwiki_original_theme
CWE
CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')