PT-2014-5570 · Frams · Frams' Fast File Exchange

Published 2014-06-18 · Updated 2014-06-18 · CVE-2014-3877

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Medium

Base vector

AV:N/AC:M/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions Frams' Fast File EXchange (F*EX, aka fex) versions prior to fex-20140530

Description The issue allows remote attackers to conduct cross-site scripting (XSS) attacks via the addto parameter to fup. This is due to an incomplete blacklist vulnerability.

Recommendations For versions prior to fex-20140530, update to version fex-20140530 or later to resolve the issue. As a temporary workaround, consider restricting access to the fup endpoint to minimize the risk of exploitation. Avoid using the addto parameter in the affected endpoint until the issue is resolved.

Exploit

Fix

Related Identifiers

CVE-2014-3877

DLA-68-1

Affected Products

Frams' Fast File Exchange

References · 8

• 🔥 http://packetstormsecurity.com/files/126906/F-EX-20140313-1-HTTP-Response-Splitting-Cross-Site-Scripting.html · Exploit
• 🔥 https://lsexperts.de/advisories/lse-2014-05-22.txt · Exploit
• https://osv.dev/vulnerability/CVE-2014-3877 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2014-3877 · Vendor Advisory
• http://fex.rus.uni-stuttgart.de/fex.html · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2014-3877 · Security Note
• https://security-tracker.debian.org/tracker/CVE-2014-3877 · Vendor Advisory
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3877 · Note