CVE-2014-2866

2022-10-0316:20:48

CWE-94

[email protected]

web.nvd.nist.gov

paperthin commonspot

cve-2014-2866

access restrictions

client-side javascript

security vulnerability

10 High

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:N/AC:L/Au:N/C:C/I:C/A:C

7.1 High

AI Score

Confidence

Low

0.004 Low

EPSS

Percentile

74.4%

JSON

PaperThin CommonSpot before 7.0.2 and 8.x before 8.0.3 relies on client JavaScript code for access restrictions, which allows remote attackers to perform unspecified operations by modifying this code.

Affected configurations

NVD

Node

paperthincommonspot_content_serverRange≤7.0.1

paperthincommonspot_content_serverMatch8.0.0

paperthincommonspot_content_serverMatch8.0.1

paperthincommonspot_content_serverMatch8.0.2

CPENameOperatorVersion
paperthin:commonspot_content_serverpaperthin commonspot content serverle7.0.1
paperthin:commonspot_content_serverpaperthin commonspot content servereq8.0.0
paperthin:commonspot_content_serverpaperthin commonspot content servereq8.0.1
paperthin:commonspot_content_serverpaperthin commonspot content servereq8.0.2

CPE	Name	Operator	Version
paperthin:commonspot_content_server	paperthin commonspot content server	le	7.0.1
paperthin:commonspot_content_server	paperthin commonspot content server	eq	8.0.0
paperthin:commonspot_content_server	paperthin commonspot content server	eq	8.0.1
paperthin:commonspot_content_server	paperthin commonspot content server	eq	8.0.2