PT-2014-5570 · Frams · Frams' Fast File Exchange

Publicado 2014-06-18 · Atualizado 2014-06-18 · CVE-2014-3877

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Média

Vetor base

AV:N/AC:M/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions Frams' Fast File EXchange (F*EX, aka fex) versions prior to fex-20140530

Description The issue allows remote attackers to conduct cross-site scripting (XSS) attacks via the addto parameter to fup. This is due to an incomplete blacklist vulnerability.

Recommendations For versions prior to fex-20140530, update to version fex-20140530 or later to resolve the issue. As a temporary workaround, consider restricting access to the fup endpoint to minimize the risk of exploitation. Avoid using the addto parameter in the affected endpoint until the issue is resolved.

Exploit

Correção

Identificadores relacionados

CVE-2014-3877

DLA-68-1

Produtos afetados

Frams' Fast File Exchange

Referências · 8

• 🔥 http://packetstormsecurity.com/files/126906/F-EX-20140313-1-HTTP-Response-Splitting-Cross-Site-Scripting.html · Exploit
• 🔥 https://lsexperts.de/advisories/lse-2014-05-22.txt · Exploit
• https://osv.dev/vulnerability/CVE-2014-3877 · Aviso do Fabricante
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3877 · Nota
• https://osv.dev/vulnerability/DEBIAN-CVE-2014-3877 · Aviso do Fabricante
• http://fex.rus.uni-stuttgart.de/fex.html · Correção
• https://nvd.nist.gov/vuln/detail/CVE-2014-3877 · Nota de Segurança
• https://security-tracker.debian.org/tracker/CVE-2014-3877 · Aviso do Fabricante