CVE-2014-0793

2014-01-3018:55:03

CWE-79

mitre

web.nvd.nist.gov

cve-2014-0793

cross-site scripting

xss

stackideas komento

joomla!

nvd

CVSS2

4.3

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:N/C:N/I:P/A:N

AI Score

5.7

Confidence

High

EPSS

0.005

Percentile

75.6%

JSON

Multiple cross-site scripting (XSS) vulnerabilities in the StackIdeas Komento (com_komento) component before 1.7.3 for Joomla! allow remote attackers to inject arbitrary web script or HTML via the (1) website or (2) latitude parameter in a comment to the default URI.

Affected configurations

Nvd

Node

stackideaskomentoRange≤1.7.2

stackideaskomentoMatch1.7.0

stackideaskomentoMatch1.7.1

AND

joomlajoomla\!

VendorProductVersionCPE
stackideaskomento*cpe:2.3:a:stackideas:komento:*:*:*:*:*:*:*:*
stackideaskomento1.7.0cpe:2.3:a:stackideas:komento:1.7.0:*:*:*:*:*:*:*
stackideaskomento1.7.1cpe:2.3:a:stackideas:komento:1.7.1:*:*:*:*:*:*:*
joomlajoomla\!*cpe:2.3:a:joomla:joomla\!:*:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
stackideas	komento	*	cpe:2.3:a:stackideas:komento::::::::
stackideas	komento	1.7.0	cpe:2.3:a:stackideas:komento:1.7.0:::::::*
stackideas	komento	1.7.1	cpe:2.3:a:stackideas:komento:1.7.1:::::::*
joomla	joomla\!	*	cpe:2.3:a:joomla:joomla\!::::::::