Lucene search

[email protected]CVE-2014-2236

HistoryMar 05, 2014 - 4:37 p.m.

CVE-2014-2236

2014-03-0516:37:40

CWE-79

[email protected]

web.nvd.nist.gov

cve-2014-2236

cross-site scripting

xss

askbot

remote attackers

web script

html

security vulnerability

4.3 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:N/C:N/I:P/A:N

5.8 Medium

AI Score

Confidence

High

0.003 Low

EPSS

Percentile

68.0%

JSON

Multiple cross-site scripting (XSS) vulnerabilities in Askbot before 0.7.49 allow remote attackers to inject arbitrary web script or HTML via vectors related to the (1) tag or (2) user search forms.

Affected configurations

NVD

Node

askbotaskbotRange≤0.7.48

askbotaskbotMatch0.7.40

askbotaskbotMatch0.7.41

askbotaskbotMatch0.7.42

askbotaskbotMatch0.7.43

askbotaskbotMatch0.7.44

askbotaskbotMatch0.7.45

askbotaskbotMatch0.7.46

askbotaskbotMatch0.7.47

CPENameOperatorVersion
askbot:askbotaskbotle0.7.48
askbot:askbotaskboteq0.7.40
askbot:askbotaskboteq0.7.41
askbot:askbotaskboteq0.7.42
askbot:askbotaskboteq0.7.43
askbot:askbotaskboteq0.7.44
askbot:askbotaskboteq0.7.45
askbot:askbotaskboteq0.7.46
askbot:askbotaskboteq0.7.47

CPE	Name	Operator	Version
askbot:askbot	askbot	le	0.7.48
askbot:askbot	askbot	eq	0.7.40
askbot:askbot	askbot	eq	0.7.41
askbot:askbot	askbot	eq	0.7.42
askbot:askbot	askbot	eq	0.7.43
askbot:askbot	askbot	eq	0.7.44
askbot:askbot	askbot	eq	0.7.45
askbot:askbot	askbot	eq	0.7.46
askbot:askbot	askbot	eq	0.7.47

References

secunia.com/advisories/57163

www.openwall.com/lists/oss-security/2014/02/28/8

www.securityfocus.com/bid/65885

bugzilla.redhat.com/show_bug.cgi?id=1070852

github.com/ASKBOT/askbot-devel/commit/876e3662ff6b78cc6241338c15e3a0cb49edf4e2#diff-b693b4c02739be4b3231bece15b0eb87

github.com/ASKBOT/askbot-devel/commit/a676a86b6b7a5737d4da4f59f71e037406f88d29

4.3 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:N/C:N/I:P/A:N

5.8 Medium

AI Score

Confidence

High

0.003 Low

EPSS

Percentile

68.0%

JSON

Related for CVE-2014-2236

prion1 cvelist1 nvd1