Lucene search

[email protected]CVE-2014-9741

HistoryOct 03, 2022 - 4:20 p.m.

CVE-2014-9741

2022-10-0316:20:40

CWE-79

[email protected]

web.nvd.nist.gov

cve-2014-9741

cross-site scripting

xss

esri arcgis

desktop

engine

server

security vulnerability

nvd

4.3 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:N/C:N/I:P/A:N

5.9 Medium

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

50.7%

JSON

Multiple cross-site scripting (XSS) vulnerabilities in ESRI ArcGIS for Desktop, ArcGIS for Engine, and ArcGIS for Server 10.2.2 and earlier allow remote attackers to inject arbitrary web script or HTML via unspecified vectors.

Affected configurations

NVD

Node

esriarcgis_for_desktopRange≤10.2.2

esriarcgis_for_engineRange≤10.2.2

esriarcgis_serverRange≤10.2.2

CPENameOperatorVersion
esri:arcgis_for_desktopesri arcgis for desktople10.2.2
esri:arcgis_for_engineesri arcgis for enginele10.2.2
esri:arcgis_serveresri arcgis serverle10.2.2

CPE	Name	Operator	Version
esri:arcgis_for_desktop	esri arcgis for desktop	le	10.2.2
esri:arcgis_for_engine	esri arcgis for engine	le	10.2.2
esri:arcgis_server	esri arcgis server	le	10.2.2

References

blogs.esri.com/esri/arcgis/2014/09/04/arcgis-for-server-security-patch-10-1-sp1-qip-10-2-1-10-2-2/

support.esri.com/en/downloads/patches-servicepacks/view/productid/67/metaid/2223

www.securitytracker.com/id/1032733

4.3 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:N/C:N/I:P/A:N

5.9 Medium

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

50.7%

JSON

Related for CVE-2014-9741

prion1 nvd1 cvelist1