CVE-2014-9599
4.3 Medium
CVSS2
Attack Vector
NETWORK
Attack Complexity
MEDIUM
Authentication
NONE
Confidentiality Impact
NONE
Integrity Impact
PARTIAL
Availability Impact
NONE
AV:N/AC:M/Au:N/C:N/I:P/A:N
5.9 Medium
AI Score
Confidence
High
0.004 Low
EPSS
Percentile
73.0%
Cross-site scripting (XSS) vulnerability in the filemanager in b2evolution before 5.2.1 allows remote attackers to inject arbitrary web script or HTML via the fm_filter parameter to blogs/admin.php.
Affected configurations
| CPE | Name | Operator | Version |
|---|---|---|---|
| b2evolution:b2evolution | b2evolution | le | 5.2.0 |
References
b2evolution.net/downloads/5-2-1-stable
packetstormsecurity.com/files/129940/CMS-b2evolution-5.2.0-Cross-Site-Scripting.html
seclists.org/fulldisclosure/2015/Jan/48
sroesemann.blogspot.de/2014/12/sroeadv-2014-09.html
sroesemann.blogspot.de/2015/01/report-for-advisory-sroeadv-2014-09.html
www.securityfocus.com/bid/72052
exchange.xforce.ibmcloud.com/vulnerabilities/99891
twitter.com/SecLists/status/554937224366546944
Social References
More
Related
4.3 Medium
CVSS2
Attack Vector
NETWORK
Attack Complexity
MEDIUM
Authentication
NONE
Confidentiality Impact
NONE
Integrity Impact
PARTIAL
Availability Impact
NONE
AV:N/AC:M/Au:N/C:N/I:P/A:N
5.9 Medium
AI Score
Confidence
High
0.004 Low
EPSS
Percentile
73.0%