Lucene search

MitreCVE-2014-5257

HistoryNov 06, 2014 - 3:55 p.m.

CVE-2014-5257

2014-11-0615:55:08

CWE-79

mitre

web.nvd.nist.gov

xss

vulnerabilities

forma lms

remote attackers

web script

html

CVSS2

4.3

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:N/C:N/I:P/A:N

AI Score

5.8

Confidence

High

EPSS

0.003

Percentile

65.5%

JSON

Multiple cross-site scripting (XSS) vulnerabilities in Forma Lms before 1.2.1 p01 allow remote attackers to inject arbitrary web script or HTML via the (1) id_custom parameter in an amanmenu request or (2) id_game parameter in an alms/games/edit request to appCore/index.php.

Affected configurations

Nvd

Node

formalmsformalmsRange≤1.2.1

VendorProductVersionCPE
formalmsformalms*cpe:2.3:a:formalms:formalms:*:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
formalms	formalms	*	cpe:2.3:a:formalms:formalms::::::::

References

packetstormsecurity.com/files/128978/Forma-Lms-1.2.1-Cross-Site-Scripting.html

sourceforge.net/projects/forma/files/version%201.x/formalms-v1.2.1-p01.zip/download

www.securityfocus.com/archive/1/533905/100/0/threaded

www.securityfocus.com/bid/70914

www.htbridge.com/advisory/HTB23226

CVSS2

4.3

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:N/C:N/I:P/A:N

AI Score

5.8

Confidence

High

EPSS

0.003

Percentile

65.5%

JSON

Related for CVE-2014-5257