CVE-2014-5326

2014-11-2402:59:03

CWE-79

[email protected]

web.nvd.nist.gov

cve-2014-5326

cross-site scripting

xss

direct web remoting

dwr

remote attackers

web script

html

4.3 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:N/C:N/I:P/A:N

5.7 Medium

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

49.8%

JSON

Cross-site scripting (XSS) vulnerability in Direct Web Remoting (DWR) through 2.0.10 and 3.x through 3.0.RC2 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.

Affected configurations

NVD

Node

directwebremotingdirect_web_remotingRange≤2.0.10

directwebremotingdirect_web_remotingMatch3.0rc1

directwebremotingdirect_web_remotingMatch3.0rc2

CPENameOperatorVersion
directwebremoting:direct_web_remotingdirectwebremoting direct web remotingle2.0.10
directwebremoting:direct_web_remotingdirectwebremoting direct web remotingeq3.0

CPE	Name	Operator	Version
directwebremoting:direct_web_remoting	directwebremoting direct web remoting	le	2.0.10
directwebremoting:direct_web_remoting	directwebremoting direct web remoting	eq	3.0