Lucene search

VulDBCVE-2014-125089

HistoryFeb 21, 2023 - 3:15 a.m.

CVE-2014-125089

2023-02-2103:15:10

CWE-79

VulDB

web.nvd.nist.gov

cve-2014-125089

cention-chatserver

remote code execution

cross site scripting

upgrade

nvd

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

SINGLE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:L/Au:S/C:N/I:P/A:N

CVSS3

6.1

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

EPSS

0.001

Percentile

37.4%

JSON

A vulnerability was found in cention-chatserver 3.8.0-rc1. It has been declared as problematic. Affected by this vulnerability is the function _formatBody of the file lib/InternalChatProtocol.fe. The manipulation of the argument body leads to cross site scripting. The attack can be launched remotely. Upgrading to version 3.9 is able to address this issue. The identifier of the patch is c4c0258bbd18f6915f97f91d5fee625384096a26. It is recommended to upgrade the affected component. The identifier VDB-221497 was assigned to this vulnerability.

Affected configurations

Nvd

Vulners

Node

cention-chatserver_projectcention-chatserverMatch3.8.0rc1

VendorProductVersionCPE
cention-chatserver_projectcention-chatserver3.8.0cpe:2.3:a:cention-chatserver_project:cention-chatserver:3.8.0:rc1:*:*:*:*:*:*

Vendor	Product	Version	CPE
cention-chatserver_project	cention-chatserver	3.8.0	cpe:2.3:a:cention-chatserver_project:cention-chatserver:3.8.0:rc1::::::

CNA Affected

[
  {
    "vendor": "n/a",
    "product": "cention-chatserver",
    "versions": [
      {
        "version": "3.8.0-rc1",
        "status": "affected"
      }
    ]
  }
]

References

github.com/cention-mujibur-rahman/cention-chatserver/commit/c4c0258bbd18f6915f97f91d5fee625384096a26

github.com/cention-mujibur-rahman/cention-chatserver/releases/tag/3.9

vuldb.com/?ctiid.221497

vuldb.com/?id.221497

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

SINGLE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:L/Au:S/C:N/I:P/A:N

CVSS3

6.1

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

EPSS

0.001

Percentile

37.4%

JSON

Related for CVE-2014-125089