Lucene search

PRIOn knowledge basePRION:CVE-2014-2021

HistoryOct 25, 2014 - 12:55 a.m.

Cross site scripting

2014-10-2500:55:00

PRIOn knowledge base

www.prio-n.com

5.7 Medium

AI Score

Confidence

High

0.005 Low

EPSS

Percentile

75.8%

JSON

Cross-site scripting (XSS) vulnerability in admincp/apilog.php in vBulletin 4.2.2 and earlier, and 5.0.x through 5.0.5 allows remote authenticated users to inject arbitrary web script or HTML via a crafted XMLRPC API request, as demonstrated using the client name.

CPENameOperatorVersion
vbulletineq5.0.0
vbulletineq5.0.5
vbulletineq5.0.3
vbulletineq5.0.2
vbulletinle4.2.2
vbulletineq5.0.1
vbulletineq5.0.4

Name	Operator	Version
vbulletin	eq	5.0.0
vbulletin	eq	5.0.5
vbulletin	eq	5.0.3
vbulletin	eq	5.0.2
vbulletin	le	4.2.2
vbulletin	eq	5.0.1
vbulletin	eq	5.0.4

References

packetstormsecurity.com/files/128691/vBulletin-5.x-4.x-Persistent-Cross-Site-Scripting.html

seclists.org/fulldisclosure/2014/Oct/55

seclists.org/fulldisclosure/2014/Oct/63

www.securityfocus.com/bid/70577

www.securitytracker.com/id/1031000

exchange.xforce.ibmcloud.com/vulnerabilities/97026

github.com/tintinweb/pub/tree/master/pocs/cve-2014-2021