CVE-2014-3808

{"id": "CVE-2014-3808", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 4.3, "accessVector": "NETWORK", "vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N", "authentication": "NONE", "integrityImpact": "PARTIAL", "accessComplexity": "MEDIUM", "availabilityImpact": "NONE", "confidentialityImpact": "NONE"}, "acInsufInfo": false, "impactScore": 2.9, "baseSeverity": "MEDIUM", "obtainAllPrivilege": false, "exploitabilityScore": 8.6, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": true}]}, "published": "2014-05-21T14:55:06.757", "references": [{"url": "http://secpod.org/advisories/SecPod_Advistory_BarracudaDrive_6.7.1_Mult_XSS_Vuln.txt", "tags": ["Exploit"], "source": "cve@mitre.org"}, {"url": "http://secpod.org/blog/?p=2309", "source": "cve@mitre.org"}, {"url": "http://secunia.com/advisories/58309", "source": "cve@mitre.org"}, {"url": "http://www.securityfocus.com/bid/67138", "source": "cve@mitre.org"}, {"url": "http://secpod.org/advisories/SecPod_Advistory_BarracudaDrive_6.7.1_Mult_XSS_Vuln.txt", "tags": ["Exploit"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "http://secpod.org/blog/?p=2309", "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "http://secunia.com/advisories/58309", "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "http://www.securityfocus.com/bid/67138", "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-79"}]}], "descriptions": [{"lang": "en", "value": "Multiple cross-site scripting (XSS) vulnerabilities in BarracudaDrive before 6.7.2 allow remote attackers to inject arbitrary web script or HTML via the (1) role parameter to roles.lsp, (2) name parameter to user.lsp, (3) path parameter to wizard/setuser.lsp, (4) host parameter to tunnelconstr.lsp, or (5) newpath parameter to wfsconstr.lsp in rtl/protected/admin/."}, {"lang": "es", "value": "M\u00faltiples vulnerabilidades de XSS en BarracudaDrive anterior a 6.7.2 permiten a atacantes remotos inyectar secuencias de comandos web o HTML arbitrarios a trav\u00e9s del (1) par\u00e1metro role hacia roles.lsp, (2) par\u00e1metro name hacia user.lsp, (3) par\u00e1metro path hacia wizard/setuser.lsp, (4) par\u00e1metro host hacia tunnelconstr.lsp o (5) par\u00e1metro newpath hacia wfsconstr.lsp en rtl/protected/admin/."}], "lastModified": "2024-11-21T02:08:53.483", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:barracudadrive:barracudadrive:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "0FE02DBE-3102-4216-8C27-E6730C870B06", "versionEndIncluding": "6.7.1"}, {"criteria": "cpe:2.3:a:barracudadrive:barracudadrive:6.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "919AC781-2DD8-4909-A177-609BA65A4ED5"}, {"criteria": "cpe:2.3:a:barracudadrive:barracudadrive:6.1:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "3F5D889C-4519-4D6A-B6B7-E650CC190F34"}, {"criteria": "cpe:2.3:a:barracudadrive:barracudadrive:6.2:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "DBCD594B-5B54-4E9C-AF33-3480DDAD4AD0"}, {"criteria": "cpe:2.3:a:barracudadrive:barracudadrive:6.3:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "B0E480CA-694D-4590-9752-E39B7FA8E07C"}, {"criteria": "cpe:2.3:a:barracudadrive:barracudadrive:6.4:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "3E1EA8D1-FD78-4830-8377-31C89A418E3C"}, {"criteria": "cpe:2.3:a:barracudadrive:barracudadrive:6.6:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "793D66D8-405F-4B9F-BF5A-169BF813DAB5"}, {"criteria": "cpe:2.3:a:barracudadrive:barracudadrive:6.7:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "F1E66E5B-C2EE-422D-A212-EF02A4FAFC91"}, {"criteria": "cpe:2.3:a:realtimelogic:barracudadrive:6.5:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "1B62D976-878B-4D55-9739-0C95E9EF7183"}], "operator": "OR"}]}], "sourceIdentifier": "cve@mitre.org"}