CVE-2014-9599
6.3 Medium
AI Score
Confidence
High
4.3 Medium
CVSS2
Access Vector
NETWORK
Access Complexity
MEDIUM
Authentication
NONE
Confidentiality Impact
NONE
Integrity Impact
PARTIAL
Availability Impact
NONE
AV:N/AC:M/Au:N/C:N/I:P/A:N
0.004 Low
EPSS
Percentile
72.8%
Cross-site scripting (XSS) vulnerability in the filemanager in b2evolution before 5.2.1 allows remote attackers to inject arbitrary web script or HTML via the fm_filter parameter to blogs/admin.php.
| CPE | Name | Operator | Version |
|---|---|---|---|
| b2evolution:b2evolution | b2evolution | le | 5.2.0 |
References
b2evolution.net/downloads/5-2-1-stable
packetstormsecurity.com/files/129940/CMS-b2evolution-5.2.0-Cross-Site-Scripting.html
seclists.org/fulldisclosure/2015/Jan/48
sroesemann.blogspot.de/2014/12/sroeadv-2014-09.html
sroesemann.blogspot.de/2015/01/report-for-advisory-sroeadv-2014-09.html
www.securityfocus.com/bid/72052
exchange.xforce.ibmcloud.com/vulnerabilities/99891
twitter.com/SecLists/status/554937224366546944
Social References
More
Related
6.3 Medium
AI Score
Confidence
High
4.3 Medium
CVSS2
Access Vector
NETWORK
Access Complexity
MEDIUM
Authentication
NONE
Confidentiality Impact
NONE
Integrity Impact
PARTIAL
Availability Impact
NONE
AV:N/AC:M/Au:N/C:N/I:P/A:N
0.004 Low
EPSS
Percentile
72.8%