PT-2014-4886 · Ektron · Ektron Cms

Published 2014-04-25 · Updated 2018-10-09 · CVE-2014-2729

Positive Technologies (AI Summary)

CVSS v2.0

3.5

Low

Base vector

AV:N/AC:M/Au:S/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions Ektron CMS 8.7 versions prior to 8.7.0.055

Description The issue is related to a cross-site scripting (XSS) vulnerability. It allows remote authenticated users to inject arbitrary web script or HTML via the category0 parameter in the content.aspx file. This occurs when the Subjects tab in the View Properties menu option is displayed, and the category0 parameter is not properly handled.

Recommendations For Ektron CMS 8.7 versions prior to 8.7.0.055, update to version 8.7.0.055 or later to resolve the issue. As a temporary workaround, consider restricting access to the content.aspx file or disabling the Subjects tab in the View Properties menu option until a patch is applied. Avoid using the category0 parameter in the affected content.aspx file until the issue is resolved.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2014-2729

Affected Products

Ektron Cms

References · 5

• 🔥 http://packetstormsecurity.com/files/126187/Ektron-CMS-8.7-Cross-Site-Scripting.html · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2014-2729 · Security Note
• http://securityfocus.com/archive/1/531853/100/0/threaded · Note
• http://securityfocus.com/archive/1/531852/100/0/threaded · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-2729 · Note