CVE-2014-4737

2014-10-1014:55:08

CWE-79

[email protected]

web.nvd.nist.gov

cve-2014-4737

cross-site scripting

xss vulnerability

textpattern cms

security vulnerability

nvd

4.3 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:N/C:N/I:P/A:N

5.6 Medium

AI Score

Confidence

High

0.003 Low

EPSS

Percentile

70.2%

JSON

Cross-site scripting (XSS) vulnerability in Textpattern CMS before 4.5.7 allows remote attackers to inject arbitrary web script or HTML via the PATH_INFO to setup/index.php.

Affected configurations

NVD

Node

textpatterntextpatternRange≤4.5.5

textpatterntextpatternMatch4.5.0

textpatterntextpatternMatch4.5.1

textpatterntextpatternMatch4.5.2

textpatterntextpatternMatch4.5.3

textpatterntextpatternMatch4.5.4

CPENameOperatorVersion
textpattern:textpatterntextpatternle4.5.5
textpattern:textpatterntextpatterneq4.5.0
textpattern:textpatterntextpatterneq4.5.1
textpattern:textpatterntextpatterneq4.5.2
textpattern:textpatterntextpatterneq4.5.3
textpattern:textpatterntextpatterneq4.5.4

CPE	Name	Operator	Version
textpattern:textpattern	textpattern	le	4.5.5
textpattern:textpattern	textpattern	eq	4.5.0
textpattern:textpattern	textpattern	eq	4.5.1
textpattern:textpattern	textpattern	eq	4.5.2
textpattern:textpattern	textpattern	eq	4.5.3
textpattern:textpattern	textpattern	eq	4.5.4