Lucene search

MitreCVE-2014-5464

HistorySep 08, 2014 - 2:55 p.m.

CVE-2014-5464

2014-09-0814:55:03

CWE-79

mitre

web.nvd.nist.gov

cve-2014-5464

cross-site scripting

xss

ndpi

traffic classification library

ntopng

ntop

http host header

CVSS2

4.3

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:N/C:N/I:P/A:N

AI Score

5.8

Confidence

High

EPSS

0.012

Percentile

85.5%

JSON

Cross-site scripting (XSS) vulnerability in the nDPI traffic classification library in ntopng (aka ntop) before 1.2.1 allows remote attackers to inject arbitrary web script or HTML via the HTTP Host header.

Affected configurations

Nvd

Node

ntopntopngRange≤1.2.0

ntopntopngMatch1.1

VendorProductVersionCPE
ntopntopng*cpe:2.3:a:ntop:ntopng:*:*:*:*:*:*:*:*
ntopntopng1.1cpe:2.3:a:ntop:ntopng:1.1:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
ntop	ntopng	*	cpe:2.3:a:ntop:ntopng::::::::
ntop	ntopng	1.1	cpe:2.3:a:ntop:ntopng:1.1:::::::*

References

osvdb.org/show/osvdb/110437

packetstormsecurity.com/files/127995/ntopng-1.2.0-Cross-Site-Scripting.html

seclists.org/fulldisclosure/2014/Aug/65

seclists.org/fulldisclosure/2014/Sep/22

seclists.org/fulldisclosure/2014/Sep/28

secunia.com/advisories/60096

www.exploit-db.com/exploits/34419

www.ntop.org/ndpi/released-ndpi-1-5-1-and-ntopng-1-2-1/

www.securityfocus.com/archive/1/533222/100/0/threaded

www.securityfocus.com/archive/1/533332/100/0/threaded

www.securityfocus.com/bid/69385

exchange.xforce.ibmcloud.com/vulnerabilities/95461

CVSS2

4.3

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:N/C:N/I:P/A:N

AI Score

5.8

Confidence

High

EPSS

0.012

Percentile

85.5%

JSON

Related for CVE-2014-5464