PT-2014-4590 · Eugene Pankov · Ajenti

Publicado 2014-04-30 · Atualizado 2022-05-17 · CVE-2014-2260

Positive Technologies (AI Summary)

CVSS v4.0

5.1

Média

Vetor base

AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N

Name of the Vulnerable Software and Affected Versions Ajenti versions 1.2.13 through 1.2.14 Ajenti version 1.2.15 is not affected, so versions prior to 1.2.15 are vulnerable. However, since 1.2.13 is the lowest version mentioned as vulnerable, the range can be simplified to: Ajenti versions 1.2.13 through 1.2.14

Description The issue is a cross-site scripting (XSS) vulnerability in the plugins/main/content/js/ajenti.coffee file. This allows remote authenticated users to inject arbitrary web script or HTML via the command field in the Cron functionality.

Recommendations For Ajenti versions 1.2.13 through 1.2.14, update to version 1.2.15 or later to resolve the issue. As a temporary workaround, consider restricting access to the Cron functionality to minimize the risk of exploitation.

Exploit

Correção

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

CVE-2014-2260

GHSA-9CRX-P357-5VW8

PYSEC-2014-98

Produtos afetados

Ajenti

Referências · 13

• 🔥 https://github.com/Eugeny/ajenti/commit/3270fd1d78391bb847b4c9ce37cf921f485b1310 · Exploit
• 🔥 http://packetstormsecurity.com/files/124804/Ajenti-1.2.13-Cross-Site-Scripting.html · Exploit
• https://github.com/ajenti/ajenti · Nota
• https://github.com/ajenti/ajenti/issues/233 · Nota
• https://github.com/ajenti/ajenti/commit/3270fd1d78391bb847b4c9ce37cf921f485b1310 · Nota
• https://github.com/pypa/advisory-database/tree/main/vulns/ajenti/PYSEC-2014-98.yaml · Nota
• https://github.com/Eugeny/ajenti/issues/233 · Nota
• http://securityfocus.com/bid/64982 · Nota
• https://osv.dev/vulnerability/PYSEC-2014-98 · Aviso do Fabricante
• https://web.archive.org/web/20200229062920/http://securityfocus.com/bid/64982 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2014-2260 · Nota de Segurança
• http://osvdb.org/102174 · Nota
• https://osv.dev/vulnerability/GHSA-9crx-p357-5vw8 · Aviso do Fabricante