CVE-2014-3808

Multiple cross-site scripting (XSS) vulnerabilities in BarracudaDrive before 6.7.2 allow remote attackers to inject arbitrary web script or HTML via the (1) role parameter to roles.lsp, (2) name parameter to user.lsp, (3) path parameter to wizard/setuser.lsp, (4) host parameter to tunnelconstr.lsp, or (5) newpath parameter to wfsconstr.lsp in rtl/protected/admin/.

CVSS v2.0 4.3 MEDIUM

4.3^/10

CVSS v2.0 : MEDIUM

Vector : AV:N/AC:M/Au:N/C:N/I:P/A:N

Exploitability : 8.6 / Impact : 2.9

Access Vector NETWORK

Access Complexity MEDIUM

Authentication NONE

Confidentiality Impact NONE

Integrity Impact PARTIAL

Availability Impact NONE

References

Link	Resource
http://secpod.org/advisories/SecPod_Advistory_BarracudaDrive_6.7.1_Mult_XSS_Vuln.txt	Exploit
http://secpod.org/blog/?p=2309
http://secunia.com/advisories/58309
http://www.securityfocus.com/bid/67138

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:barracudadrive:barracudadrive::::::::
	cpe:2.3:a:barracudadrive:barracudadrive:6.0:::::::*
	cpe:2.3:a:barracudadrive:barracudadrive:6.1:::::::*
	cpe:2.3:a:barracudadrive:barracudadrive:6.2:::::::*
	cpe:2.3:a:barracudadrive:barracudadrive:6.3:::::::*
	cpe:2.3:a:barracudadrive:barracudadrive:6.4:::::::*
	cpe:2.3:a:barracudadrive:barracudadrive:6.6:::::::*
	cpe:2.3:a:barracudadrive:barracudadrive:6.7:::::::*
	cpe:2.3:a:realtimelogic:barracudadrive:6.5:::::::*

History

No history.

Information

Published : 2014-05-21 14:55

Updated : 2024-02-28 12:20

NVD link : CVE-2014-3808

Mitre link : CVE-2014-3808

CVE.ORG link : CVE-2014-3808

JSON object : View

Products Affected

barracudadrive

barracudadrive

realtimelogic

barracudadrive

CWE

CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

{"id": "CVE-2014-3808", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 4.3, "accessVector": "NETWORK", "vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N", "authentication": "NONE", "integrityImpact": "PARTIAL", "accessComplexity": "MEDIUM", "availabilityImpact": "NONE", "confidentialityImpact": "NONE"}, "acInsufInfo": false, "impactScore": 2.9, "baseSeverity": "MEDIUM", "obtainAllPrivilege": false, "exploitabilityScore": 8.6, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": true}]}, "published": "2014-05-21T14:55:06.757", "references": [{"url": "http://secpod.org/advisories/SecPod_Advistory_BarracudaDrive_6.7.1_Mult_XSS_Vuln.txt", "tags": ["Exploit"], "source": "cve@mitre.org"}, {"url": "http://secpod.org/blog/?p=2309", "source": "cve@mitre.org"}, {"url": "http://secunia.com/advisories/58309", "source": "cve@mitre.org"}, {"url": "http://www.securityfocus.com/bid/67138", "source": "cve@mitre.org"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-79"}]}], "descriptions": [{"lang": "en", "value": "Multiple cross-site scripting (XSS) vulnerabilities in BarracudaDrive before 6.7.2 allow remote attackers to inject arbitrary web script or HTML via the (1) role parameter to roles.lsp, (2) name parameter to user.lsp, (3) path parameter to wizard/setuser.lsp, (4) host parameter to tunnelconstr.lsp, or (5) newpath parameter to wfsconstr.lsp in rtl/protected/admin/."}, {"lang": "es", "value": "M\u00faltiples vulnerabilidades de XSS en BarracudaDrive anterior a 6.7.2 permiten a atacantes remotos inyectar secuencias de comandos web o HTML arbitrarios a trav\u00e9s del (1) par\u00e1metro role hacia roles.lsp, (2) par\u00e1metro name hacia user.lsp, (3) par\u00e1metro path hacia wizard/setuser.lsp, (4) par\u00e1metro host hacia tunnelconstr.lsp o (5) par\u00e1metro newpath hacia wfsconstr.lsp en rtl/protected/admin/."}], "lastModified": "2021-05-26T17:30:28.270", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:barracudadrive:barracudadrive:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "0FE02DBE-3102-4216-8C27-E6730C870B06", "versionEndIncluding": "6.7.1"}, {"criteria": "cpe:2.3:a:barracudadrive:barracudadrive:6.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "919AC781-2DD8-4909-A177-609BA65A4ED5"}, {"criteria": "cpe:2.3:a:barracudadrive:barracudadrive:6.1:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "3F5D889C-4519-4D6A-B6B7-E650CC190F34"}, {"criteria": "cpe:2.3:a:barracudadrive:barracudadrive:6.2:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "DBCD594B-5B54-4E9C-AF33-3480DDAD4AD0"}, {"criteria": "cpe:2.3:a:barracudadrive:barracudadrive:6.3:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "B0E480CA-694D-4590-9752-E39B7FA8E07C"}, {"criteria": "cpe:2.3:a:barracudadrive:barracudadrive:6.4:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "3E1EA8D1-FD78-4830-8377-31C89A418E3C"}, {"criteria": "cpe:2.3:a:barracudadrive:barracudadrive:6.6:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "793D66D8-405F-4B9F-BF5A-169BF813DAB5"}, {"criteria": "cpe:2.3:a:barracudadrive:barracudadrive:6.7:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "F1E66E5B-C2EE-422D-A212-EF02A4FAFC91"}, {"criteria": "cpe:2.3:a:realtimelogic:barracudadrive:6.5:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "1B62D976-878B-4D55-9739-0C95E9EF7183"}], "operator": "OR"}]}], "sourceIdentifier": "cve@mitre.org"}