CVE-2014-0332

Cross-site scripting (XSS) vulnerability in mainPage in Dell SonicWALL GMS before 7.1 SP2, SonicWALL Analyzer before 7.1 SP2, and SonicWALL UMA E5000 before 7.1 SP2 might allow remote attackers to inject arbitrary web script or HTML via the node_id parameter in a ScreenDisplayManager genNetwork action.

CVSS v2.0 4.3 MEDIUM

4.3^/10

CVSS v2.0 : MEDIUM

Vector : AV:N/AC:M/Au:N/C:N/I:P/A:N

Exploitability : 8.6 / Impact : 2.9

Access Vector NETWORK

Access Complexity MEDIUM

Authentication NONE

Confidentiality Impact NONE

Integrity Impact PARTIAL

Availability Impact NONE

References

Link	Resource
http://www.sonicwall.com/us/shared/download/Support_Bulletin_GMS_Vulnerability_XSS_Resolved_in_7.1_SP2_and_7.2.pdf	Vendor Advisory
http://www.kb.cert.org/vuls/id/727318	Third Party Advisory US Government Resource
http://osvdb.org/103216	Broken Link
http://www.securityfocus.com/bid/65498	Third Party Advisory VDB Entry
https://exchange.xforce.ibmcloud.com/vulnerabilities/91062	VDB Entry

Advertisement

Configurations

Configuration 1 (hide)

AND

OR	cpe:2.3:a:sonicwall:global_management_system:7.1:sp1::::::
	cpe:2.3:a:sonicwall:global_management_system:7.1:::::::*
	cpe:2.3:a:sonicwall:global_management_system:7.0:::::::*

cpe:2.3:h:sonicwall:uma_e5000:-:*:*:*:*:*:*:*

Configuration 2 (hide)

OR	cpe:2.3:a:sonicwall:analyzer:7.1:sp1::::::
	cpe:2.3:a:sonicwall:analyzer:7.0:::::::*
	cpe:2.3:a:sonicwall:analyzer:7.1:::::::*

Configuration 3 (hide)

OR	cpe:2.3:a:sonicwall:global_management_system:7.0:::::::*
	cpe:2.3:a:sonicwall:global_management_system:7.1:sp1::::::
	cpe:2.3:a:sonicwall:global_management_system:7.1:::::::*

Information

Published : 2014-02-14 08:55

Updated : 2018-03-12 10:23

NVD link : CVE-2014-0332

Mitre link : CVE-2014-0332

JSON object : View

CWE

CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Advertisement

Products Affected

sonicwall

global_management_system
uma_e5000
analyzer

{"cve": {"data_type": "CVE", "references": {"reference_data": [{"url": "http://www.sonicwall.com/us/shared/download/Support_Bulletin_GMS_Vulnerability_XSS_Resolved_in_7.1_SP2_and_7.2.pdf", "name": "http://www.sonicwall.com/us/shared/download/Support_Bulletin_GMS_Vulnerability_XSS_Resolved_in_7.1_SP2_and_7.2.pdf", "tags": ["Vendor Advisory"], "refsource": "CONFIRM"}, {"url": "http://www.kb.cert.org/vuls/id/727318", "name": "VU#727318", "tags": ["Third Party Advisory", "US Government Resource"], "refsource": "CERT-VN"}, {"url": "http://osvdb.org/103216", "name": "103216", "tags": ["Broken Link"], "refsource": "OSVDB"}, {"url": "http://www.securityfocus.com/bid/65498", "name": "65498", "tags": ["Third Party Advisory", "VDB Entry"], "refsource": "BID"}, {"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/91062", "name": "sonicwall-cve20140332-nodeid-xss(91062)", "tags": ["VDB Entry"], "refsource": "XF"}]}, "data_format": "MITRE", "description": {"description_data": [{"lang": "en", "value": "Cross-site scripting (XSS) vulnerability in mainPage in Dell SonicWALL GMS before 7.1 SP2, SonicWALL Analyzer before 7.1 SP2, and SonicWALL UMA E5000 before 7.1 SP2 might allow remote attackers to inject arbitrary web script or HTML via the node_id parameter in a ScreenDisplayManager genNetwork action."}]}, "problemtype": {"problemtype_data": [{"description": [{"lang": "en", "value": "CWE-79"}]}]}, "data_version": "4.0", "CVE_data_meta": {"ID": "CVE-2014-0332", "ASSIGNER": "cert@cert.org"}}, "impact": {"baseMetricV2": {"cvssV2": {"version": "2.0", "baseScore": 4.3, "accessVector": "NETWORK", "vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N", "authentication": "NONE", "integrityImpact": "PARTIAL", "accessComplexity": "MEDIUM", "availabilityImpact": "NONE", "confidentialityImpact": "NONE"}, "severity": "MEDIUM", "impactScore": 2.9, "obtainAllPrivilege": false, "exploitabilityScore": 8.6, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": true}}, "publishedDate": "2014-02-14T16:55Z", "configurations": {"nodes": [{"children": [{"children": [], "operator": "OR", "cpe_match": [{"cpe23Uri": "cpe:2.3:a:sonicwall:global_management_system:7.1:sp1:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}, {"cpe23Uri": "cpe:2.3:a:sonicwall:global_management_system:7.1:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}, {"cpe23Uri": "cpe:2.3:a:sonicwall:global_management_system:7.0:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}]}, {"children": [], "operator": "OR", "cpe_match": [{"cpe23Uri": "cpe:2.3:h:sonicwall:uma_e5000:-:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": false}]}], "operator": "AND", "cpe_match": []}, {"children": [], "operator": "OR", "cpe_match": [{"cpe23Uri": "cpe:2.3:a:sonicwall:analyzer:7.1:sp1:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}, {"cpe23Uri": "cpe:2.3:a:sonicwall:analyzer:7.0:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}, {"cpe23Uri": "cpe:2.3:a:sonicwall:analyzer:7.1:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}]}, {"children": [], "operator": "OR", "cpe_match": [{"cpe23Uri": "cpe:2.3:a:sonicwall:global_management_system:7.0:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}, {"cpe23Uri": "cpe:2.3:a:sonicwall:global_management_system:7.1:sp1:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}, {"cpe23Uri": "cpe:2.3:a:sonicwall:global_management_system:7.1:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}]}], "CVE_data_version": "4.0"}, "lastModifiedDate": "2018-03-12T17:23Z"}