Lucene search

[email protected]CVE-2013-2643

HistoryMar 18, 2014 - 5:02 p.m.

CVE-2013-2643

2014-03-1817:02:51

CWE-79

[email protected]

web.nvd.nist.gov

sophos

web appliance

xss

cross-site scripting

vulnerability

security

nvd

5.7 Medium

AI Score

Confidence

High

4.3 Medium

CVSS2

Access Vector

Access Complexity

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:N/C:N/I:P/A:N

0.003 Low

EPSS

Percentile

67.8%

JSON

Multiple cross-site scripting (XSS) vulnerabilities in Sophos Web Appliance before 3.7.8.2 allow remote attackers to inject arbitrary web script or HTML via the (1) xss parameter in an allow action to rss.php, (2) msg parameter to end-user/errdoc.php, (3) h parameter to end-user/ftp_redirect.php, or (4) threat parameter to the Blocked component.

Affected configurations

NVD

Node

sophosweb_appliance_firmwareRange≤3.7.8.1

AND

sophosweb_applianceMatch-

CPENameOperatorVersion
sophos:web_appliance_firmwaresophos web appliance firmwarele3.7.8.1
sophos:web_appliancesophos web applianceeq-

CPE	Name	Operator	Version
sophos:web_appliance_firmware	sophos web appliance firmware	le	3.7.8.1
sophos:web_appliance	sophos web appliance	eq	-

References

www.sophos.com/en-us/support/knowledgebase/118969.aspx

www.sec-consult.com/fxdata/seccons/prod/temedia/advisories_txt/20130403-0_Sophos_Web_Protection_Appliance_Multiple_Vulnerabilities.txt

5.7 Medium

AI Score

Confidence

High

4.3 Medium

CVSS2

Access Vector

Access Complexity

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:N/C:N/I:P/A:N

0.003 Low

EPSS

Percentile

67.8%

JSON

Related for CVE-2013-2643

prion1 cvelist1 nvd1 nessus1 zdt1 securityvulns2 packetstorm1 exploitpack1 openvas1 exploitdb1