CVE-2014-9606

Multiple cross-site scripting (XSS) vulnerabilities in Netsweeper before 3.1.10, 4.0.x before 4.0.9, and 4.1.x before 4.1.2 allow remote attackers to inject arbitrary web script or HTML via the (1) server parameter to remotereporter/load_logfiles.php, (2) customctid parameter to webadmin/policy/category_table_ajax.php, (3) urllist parameter to webadmin/alert/alert.php, (4) QUERY_STRING to webadmin/ajaxfilemanager/ajax_get_file_listing.php, or (5) PATH_INFO to webadmin/policy/policy_table_ajax.php/.

CVSS v3 6.1 MEDIUM
CVSS v2.0 4.3 MEDIUM

6.1^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 2.8 / Impact : 2.7

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction REQUIRED

Confidentiality Impact LOW

Integrity Impact LOW

Availability Impact NONE

Scope CHANGED

4.3^/10

CVSS v2.0 : MEDIUM

Vector : AV:N/AC:M/Au:N/C:N/I:P/A:N

Exploitability : 8.6 / Impact : 2.9

Access Vector NETWORK

Access Complexity MEDIUM

Authentication NONE

Confidentiality Impact NONE

Integrity Impact PARTIAL

Availability Impact NONE

References

Link	Resource
http://packetstormsecurity.com/files/133034/Netsweeper-Bypass-XSS-Redirection-SQL-Injection-Execution.html	Third Party Advisory VDB Entry
http://packetstormsecurity.com/files/133034/Netsweeper-Bypass-XSS-Redirection-SQL-Injection-Execution.html	Third Party Advisory VDB Entry

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:netsweeper:netsweeper::::::::
	cpe:2.3:a:netsweeper:netsweeper::::::::
	cpe:2.3:a:netsweeper:netsweeper::::::::

History

21 Nov 2024, 02:21

Type	Values Removed	Values Added
References	~~() http://packetstormsecurity.com/files/133034/Netsweeper-Bypass-XSS-Redirection-SQL-Injection-Execution.html - Third Party Advisory, VDB Entry~~	() http://packetstormsecurity.com/files/133034/Netsweeper-Bypass-XSS-Redirection-SQL-Injection-Execution.html - Third Party Advisory, VDB Entry

Information

Published : 2020-02-19 20:15

Updated : 2024-11-21 02:21

NVD link : CVE-2014-9606

Mitre link : CVE-2014-9606

CVE.ORG link : CVE-2014-9606

JSON object : View

Products Affected

netsweeper

netsweeper

CWE

CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

{"id": "CVE-2014-9606", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 4.3, "accessVector": "NETWORK", "vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N", "authentication": "NONE", "integrityImpact": "PARTIAL", "accessComplexity": "MEDIUM", "availabilityImpact": "NONE", "confidentialityImpact": "NONE"}, "acInsufInfo": false, "impactScore": 2.9, "baseSeverity": "MEDIUM", "obtainAllPrivilege": false, "exploitabilityScore": 8.6, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": true}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 6.1, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}, "impactScore": 2.7, "exploitabilityScore": 2.8}]}, "published": "2020-02-19T20:15:13.017", "references": [{"url": "http://packetstormsecurity.com/files/133034/Netsweeper-Bypass-XSS-Redirection-SQL-Injection-Execution.html", "tags": ["Third Party Advisory", "VDB Entry"], "source": "cve@mitre.org"}, {"url": "http://packetstormsecurity.com/files/133034/Netsweeper-Bypass-XSS-Redirection-SQL-Injection-Execution.html", "tags": ["Third Party Advisory", "VDB Entry"], "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-79"}]}], "descriptions": [{"lang": "en", "value": "Multiple cross-site scripting (XSS) vulnerabilities in Netsweeper before 3.1.10, 4.0.x before 4.0.9, and 4.1.x before 4.1.2 allow remote attackers to inject arbitrary web script or HTML via the (1) server parameter to remotereporter/load_logfiles.php, (2) customctid parameter to webadmin/policy/category_table_ajax.php, (3) urllist parameter to webadmin/alert/alert.php, (4) QUERY_STRING to webadmin/ajaxfilemanager/ajax_get_file_listing.php, or (5) PATH_INFO to webadmin/policy/policy_table_ajax.php/."}, {"lang": "es", "value": "M\u00faltiples vulnerabilidades de tipo cross-site scripting (XSS) en Netsweeper versiones anteriores a 3.1.10, versiones 4.0.x anteriores a 4.0.9 y versiones 4.1.x anteriores a 4.1.2, permiten a atacantes remotos inyectar script web o HTML arbitrario por medio del (1) par\u00e1metro server en el archivo remotereporter/load_logfiles.php, (2) par\u00e1metro customctid en el archivo webadmin/policy/category_table_ajax.php, (3) par\u00e1metro urllist en el archivo webadmin/alert/alert.php, (4) par\u00e1metro QUERY_STRING en el archivo webadmin/ajaxfilemanager/ajax_get_file_listing.php, o (5) par\u00e1metro PATH_INFO en el archivo webadmin/policy/policy_table_ajax.php/."}], "lastModified": "2024-11-21T02:21:13.830", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:netsweeper:netsweeper:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "EC03E17D-C596-4F69-8CAC-9634EB57E70C", "versionEndExcluding": "3.1.10"}, {"criteria": "cpe:2.3:a:netsweeper:netsweeper:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "C42E93CB-FD37-4C3C-ACF9-414CDE74B456", "versionEndExcluding": "4.0.9", "versionStartIncluding": "4.0.0"}, {"criteria": "cpe:2.3:a:netsweeper:netsweeper:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "3C92CF1B-0A06-4122-828B-ED542B1E90BF", "versionEndExcluding": "4.1.2", "versionStartIncluding": "4.1.0"}], "operator": "OR"}]}], "sourceIdentifier": "cve@mitre.org"}