PT-2014-8315 · Red Hat · Freeipa

Pvoborni · Publicado 2014-11-28 · Atualizado 2015-02-17 · CVE-2014-7850

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Média

Vetor base

AV:N/AC:M/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions FreeIPA versions 4.0 through 4.1.1 FreeIPA version 4.1.2 is not affected, but all versions prior to 4.1.2 are vulnerable, so the correct representation is: FreeIPA versions prior to 4.1.2

Description A cross-site scripting (XSS) issue exists in the Web UI, allowing remote attackers to inject arbitrary web script or HTML via vectors related to breadcrumb navigation.

Recommendations For FreeIPA versions prior to 4.1.2, update to version 4.1.2 or later to resolve the issue.

Correção

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

CVE-2014-7850

Produtos afetados

Freeipa

Referências · 11

• https://osv.dev/vulnerability/CVE-2014-7850 · Aviso do Fabricante
• https://osv.dev/vulnerability/DEBIAN-CVE-2014-7850 · Aviso do Fabricante
• https://osv.dev/vulnerability/UBUNTU-CVE-2014-7850 · Aviso do Fabricante
• https://bugzilla.redhat.com/show_bug.cgi?id=1165280 · Aviso do Fabricante
• https://ubuntu.com/security/CVE-2014-7850 · Aviso do Fabricante
• https://security-tracker.debian.org/tracker/CVE-2014-7850 · Aviso do Fabricante
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-7850 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2014-7850 · Nota de Segurança
• https://cve.org/CVERecord?id=CVE-2014-7850 · Nota de Segurança
• http://lists.fedoraproject.org/pipermail/package-announce/2014-November/144848.html · Aviso do Fabricante
• https://fedorahosted.org/freeipa/ticket/4742 · Aviso do Fabricante