CVE-2014-2577

2014-06-0517:55:06

CWE-79

[email protected]

web.nvd.nist.gov

cve-2014-2577

cross-site scripting

xss vulnerabilities

bottomline technologies

transform foundation server

nvd

4.3 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:N/C:N/I:P/A:N

5.8 Medium

AI Score

Confidence

High

0.006 Low

EPSS

Percentile

77.7%

JSON

Multiple cross-site scripting (XSS) vulnerabilities in the Transform Content Center in Bottomline Technologies Transform Foundation Server before 4.3.1 Patch 8 and 5.x before 5.2 Patch 7 allow remote attackers to inject arbitrary web script or HTML via the (1) pn parameter to index.fsp/document.pdf, (2) db or (3) referer parameter to index.fsp/index.fsp, or (4) PATH_INFO to the default URI.

Affected configurations

NVD

Node

bottomlinetransform_foundation_serverMatch4.3.1

bottomlinetransform_foundation_serverMatch5.2

CPENameOperatorVersion
bottomline:transform_foundation_serverbottomline transform foundation servereq4.3.1
bottomline:transform_foundation_serverbottomline transform foundation servereq5.2

CPE	Name	Operator	Version
bottomline:transform_foundation_server	bottomline transform foundation server	eq	4.3.1
bottomline:transform_foundation_server	bottomline transform foundation server	eq	5.2