Overview
PivotX 2.3.8, and possibly earlier versions, contains cross-site scripting (CWE-79) and unsafe file upload (CWE-434) vulnerabilities.
Description
PivotX 2.3.8, and possibly earlier versions, contains cross-site scripting (CWE-79) and unsafe file upload (CWE-434) vulnerabilities. CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') - CVE-2014-0341 |
Impact
A remote authenticated attacker may be able to inject arbitrary script into a web page or upload a malicious file. |
Solution
Apply an Update |
Vendor Information
CVSS Metrics
| Group | Score | Vector |
|---|---|---|
| Base | 6.5 | AV:N/AC:L/Au:S/C:P/I:P/A:P |
| Temporal | 5.1 | E:POC/RL:OF/RC:C |
| Environmental | 1.3 | CDP:ND/TD:L/CR:ND/IR:ND/AR:ND |
References
Acknowledgements
Thanks to Diego Garc for reporting these vulnerabilities.
This document was written by Jared Allar.
Other Information
| CVE IDs: | CVE-2014-0341, CVE-2014-0342 |
| Date Public: | 2014-03-05 |
| Date First Published: | 2014-04-11 |
| Date Last Updated: | 2014-07-24 21:10 UTC |
| Document Revision: | 7 |