Lucene search

[email protected]CVE-2014-3758

HistoryMay 16, 2014 - 2:55 p.m.

CVE-2014-3758

2014-05-1614:55:05

CWE-79

[email protected]

web.nvd.nist.gov

cve-2014-3758

cross-site scripting

xss

vulnerability

bibtex publications

si_bibtex

typo3

remote attackers

web script

html

import functionality

4.3 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:N/C:N/I:P/A:N

5.8 Medium

AI Score

Confidence

High

0.002 Low

EPSS

Percentile

60.3%

JSON

Cross-site scripting (XSS) vulnerability in the BibTex Publications (si_bibtex) extension 0.2.3 for TYPO3 allows remote attackers to inject arbitrary web script or HTML via vectors related to the import functionality.

Affected configurations

NVD

Node

karlen_waltersi_bibtexMatch0.2.3typo3

CPENameOperatorVersion
karlen_walter:si_bibtexkarlen walter si bibtexeq0.2.3

CPE	Name	Operator	Version
karlen_walter:si_bibtex	karlen walter si bibtex	eq	0.2.3

References

seclists.org/fulldisclosure/2014/Apr/314

www.securityfocus.com/archive/1/531980/100/0/threaded

www.securityfocus.com/bid/67145

www.sec-consult.com/fxdata/seccons/prod/temedia/advisories_txt/20140430-0_Typo3_si_bibtex_extension_SQL_injection_and_XSS_vulnerabilities_v10.txt

4.3 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:N/C:N/I:P/A:N

5.8 Medium

AI Score

Confidence

High

0.002 Low

EPSS

Percentile

60.3%

JSON

Related for CVE-2014-3758

cvelist1 typo32 nvd1 prion1