CVE-2013-2643

2014-03-1817:02:51

CWE-79

mitre

web.nvd.nist.gov

sophos

web appliance

xss

cross-site scripting

vulnerability

security

nvd

CVSS2

4.3

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:N/C:N/I:P/A:N

AI Score

5.7

Confidence

High

EPSS

0.003

Percentile

67.9%

JSON

Multiple cross-site scripting (XSS) vulnerabilities in Sophos Web Appliance before 3.7.8.2 allow remote attackers to inject arbitrary web script or HTML via the (1) xss parameter in an allow action to rss.php, (2) msg parameter to end-user/errdoc.php, (3) h parameter to end-user/ftp_redirect.php, or (4) threat parameter to the Blocked component.

Affected configurations

Nvd

Node

sophosweb_appliance_firmwareRange≤3.7.8.1

AND

sophosweb_applianceMatch-

VendorProductVersionCPE
sophosweb_appliance_firmware*cpe:2.3:o:sophos:web_appliance_firmware:*:*:*:*:*:*:*:*
sophosweb_appliance-cpe:2.3:h:sophos:web_appliance:-:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
sophos	web_appliance_firmware	*	cpe:2.3:o:sophos:web_appliance_firmware::::::::
sophos	web_appliance	-	cpe:2.3:h:sophos:web_appliance:-:::::::*