CVE-2014-3808

Multiple cross-site scripting (XSS) vulnerabilities in BarracudaDrive before 6.7.2 allow remote attackers to inject arbitrary web script or HTML via the (1) role parameter to roles.lsp, (2) name parameter to user.lsp, (3) path parameter to wizard/setuser.lsp, (4) host parameter to tunnelconstr.lsp, or (5) newpath parameter to wfsconstr.lsp in rtl/protected/admin/.

CVSS v2.0 4.3 MEDIUM

4.3^/10

CVSS v2.0 : MEDIUM

Vector : AV:N/AC:M/Au:N/C:N/I:P/A:N

Exploitability : 8.6 / Impact : 2.9

Access Vector NETWORK

Access Complexity MEDIUM

Authentication NONE

Confidentiality Impact NONE

Integrity Impact PARTIAL

Availability Impact NONE

References

Link	Resource
http://secpod.org/advisories/SecPod_Advistory_BarracudaDrive_6.7.1_Mult_XSS_Vuln.txt	Exploit
http://secpod.org/blog/?p=2309
http://secunia.com/advisories/58309
http://www.securityfocus.com/bid/67138

Advertisement

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:barracudadrive:barracudadrive:6.6:::::::*
	cpe:2.3:a:barracudadrive:barracudadrive::::::::
	cpe:2.3:a:barracudadrive:barracudadrive:6.4:::::::*
	cpe:2.3:a:barracudadrive:barracudadrive:6.3:::::::*
	cpe:2.3:a:barracudadrive:barracudadrive:6.2:::::::*
	cpe:2.3:a:barracudadrive:barracudadrive:6.1:::::::*
	cpe:2.3:a:barracudadrive:barracudadrive:6.7:::::::*
	cpe:2.3:a:realtimelogic:barracudadrive:6.5:::::::*
	cpe:2.3:a:barracudadrive:barracudadrive:6.0:::::::*

Information

Published : 2014-05-21 07:55

Updated : 2021-05-26 10:30

NVD link : CVE-2014-3808

Mitre link : CVE-2014-3808

JSON object : View

CWE

CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Advertisement

Products Affected

barracudadrive

barracudadrive

realtimelogic

barracudadrive

{"cve": {"data_type": "CVE", "references": {"reference_data": [{"url": "http://secpod.org/advisories/SecPod_Advistory_BarracudaDrive_6.7.1_Mult_XSS_Vuln.txt", "name": "http://secpod.org/advisories/SecPod_Advistory_BarracudaDrive_6.7.1_Mult_XSS_Vuln.txt", "tags": ["Exploit"], "refsource": "MISC"}, {"url": "http://secpod.org/blog/?p=2309", "name": "http://secpod.org/blog/?p=2309", "tags": [], "refsource": "MISC"}, {"url": "http://secunia.com/advisories/58309", "name": "58309", "tags": [], "refsource": "SECUNIA"}, {"url": "http://www.securityfocus.com/bid/67138", "name": "67138", "tags": [], "refsource": "BID"}]}, "data_format": "MITRE", "description": {"description_data": [{"lang": "en", "value": "Multiple cross-site scripting (XSS) vulnerabilities in BarracudaDrive before 6.7.2 allow remote attackers to inject arbitrary web script or HTML via the (1) role parameter to roles.lsp, (2) name parameter to user.lsp, (3) path parameter to wizard/setuser.lsp, (4) host parameter to tunnelconstr.lsp, or (5) newpath parameter to wfsconstr.lsp in rtl/protected/admin/."}]}, "problemtype": {"problemtype_data": [{"description": [{"lang": "en", "value": "CWE-79"}]}]}, "data_version": "4.0", "CVE_data_meta": {"ID": "CVE-2014-3808", "ASSIGNER": "cve@mitre.org"}}, "impact": {"baseMetricV2": {"cvssV2": {"version": "2.0", "baseScore": 4.3, "accessVector": "NETWORK", "vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N", "authentication": "NONE", "integrityImpact": "PARTIAL", "accessComplexity": "MEDIUM", "availabilityImpact": "NONE", "confidentialityImpact": "NONE"}, "severity": "MEDIUM", "impactScore": 2.9, "obtainAllPrivilege": false, "exploitabilityScore": 8.6, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": true}}, "publishedDate": "2014-05-21T14:55Z", "configurations": {"nodes": [{"children": [], "operator": "OR", "cpe_match": [{"cpe23Uri": "cpe:2.3:a:barracudadrive:barracudadrive:6.6:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}, {"cpe23Uri": "cpe:2.3:a:barracudadrive:barracudadrive:*:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true, "versionEndIncluding": "6.7.1"}, {"cpe23Uri": "cpe:2.3:a:barracudadrive:barracudadrive:6.4:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}, {"cpe23Uri": "cpe:2.3:a:barracudadrive:barracudadrive:6.3:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}, {"cpe23Uri": "cpe:2.3:a:barracudadrive:barracudadrive:6.2:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}, {"cpe23Uri": "cpe:2.3:a:barracudadrive:barracudadrive:6.1:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}, {"cpe23Uri": "cpe:2.3:a:barracudadrive:barracudadrive:6.7:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}, {"cpe23Uri": "cpe:2.3:a:realtimelogic:barracudadrive:6.5:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}, {"cpe23Uri": "cpe:2.3:a:barracudadrive:barracudadrive:6.0:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}]}], "CVE_data_version": "4.0"}, "lastModifiedDate": "2021-05-26T17:30Z"}