PT-2014-8315 · Red Hat · Freeipa

Pvoborni · Published 2014-11-28 · Updated 2015-02-17 · CVE-2014-7850

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Medium

Base vector

AV:N/AC:M/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions FreeIPA versions 4.0 through 4.1.1 FreeIPA version 4.1.2 is not affected, but all versions prior to 4.1.2 are vulnerable, so the correct representation is: FreeIPA versions prior to 4.1.2

Description A cross-site scripting (XSS) issue exists in the Web UI, allowing remote attackers to inject arbitrary web script or HTML via vectors related to breadcrumb navigation.

Recommendations For FreeIPA versions prior to 4.1.2, update to version 4.1.2 or later to resolve the issue.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2014-7850

Affected Products

Freeipa

References · 11

• https://osv.dev/vulnerability/CVE-2014-7850 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2014-7850 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2014-7850 · Vendor Advisory
• https://bugzilla.redhat.com/show_bug.cgi?id=1165280 · Vendor Advisory
• https://ubuntu.com/security/CVE-2014-7850 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2014-7850 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2014-7850 · Security Note
• https://cve.org/CVERecord?id=CVE-2014-7850 · Security Note
• http://lists.fedoraproject.org/pipermail/package-announce/2014-November/144848.html · Vendor Advisory
• https://fedorahosted.org/freeipa/ticket/4742 · Vendor Advisory
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-7850 · Note