Lucene search

MitreCVE-2014-8365

HistoryOct 20, 2014 - 6:55 p.m.

CVE-2014-8365

2014-10-2018:55:03

CWE-79

mitre

web.nvd.nist.gov

cve-2014-8365

cross-site scripting

xss

xornic contact us

remote attackers

web script

html

contact.php

path_info

setup.php

php_self variable

CVSS2

4.3

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:N/C:N/I:P/A:N

AI Score

5.9

Confidence

High

EPSS

0.001

Percentile

50.2%

JSON

Multiple cross-site scripting (XSS) vulnerabilities in Xornic Contact Us allow remote attackers to inject arbitrary web script or HTML via the (1) name or (2) email parameter to contact.php or (3) PATH_INFO to setup.php, related to the “PHP_SELF” variable.

Affected configurations

Nvd

Node

xorniccontact_usMatch1.0

VendorProductVersionCPE
xorniccontact_us1.0cpe:2.3:a:xornic:contact_us:1.0:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
xornic	contact_us	1.0	cpe:2.3:a:xornic:contact_us:1.0:::::::*

References

packetstormsecurity.com/files/127003/Xornic-Contact-Us-Form-CAPTCHA-Bypass-XSS.html

seclists.org/fulldisclosure/2014/Jun/40

CVSS2

4.3

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:N/C:N/I:P/A:N

AI Score

5.9

Confidence

High

EPSS

0.001

Percentile

50.2%

JSON

Related for CVE-2014-8365