PT-2014-4886 · Ektron · Ektron Cms

Publicado 2014-04-25 · Atualizado 2018-10-09 · CVE-2014-2729

Positive Technologies (AI Summary)

CVSS v2.0

3.5

Baixa

Vetor base

AV:N/AC:M/Au:S/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions Ektron CMS 8.7 versions prior to 8.7.0.055

Description The issue is related to a cross-site scripting (XSS) vulnerability. It allows remote authenticated users to inject arbitrary web script or HTML via the category0 parameter in the content.aspx file. This occurs when the Subjects tab in the View Properties menu option is displayed, and the category0 parameter is not properly handled.

Recommendations For Ektron CMS 8.7 versions prior to 8.7.0.055, update to version 8.7.0.055 or later to resolve the issue. As a temporary workaround, consider restricting access to the content.aspx file or disabling the Subjects tab in the View Properties menu option until a patch is applied. Avoid using the category0 parameter in the affected content.aspx file until the issue is resolved.

Exploit

Correção

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

CVE-2014-2729

Produtos afetados

Ektron Cms

Referências · 5

• 🔥 http://packetstormsecurity.com/files/126187/Ektron-CMS-8.7-Cross-Site-Scripting.html · Exploit
• http://securityfocus.com/archive/1/531853/100/0/threaded · Nota
• http://securityfocus.com/archive/1/531852/100/0/threaded · Nota
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-2729 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2014-2729 · Nota de Segurança