CVE-2014-100004
published 2015-01-13CVE-2014-100004: Cross-site scripting (XSS) vulnerability in Sitecore CMS before 7.0 Update-4 (rev. 140120) allows remote attackers to inject arbitrary web script or HTML via…
PriorityP420medium4.3CVSS 2.0
AVNACMAuNCNIPAN
EXPLOIT
EPSS
2.02%
78.5th percentile
Cross-site scripting (XSS) vulnerability in Sitecore CMS before 7.0 Update-4 (rev. 140120) allows remote attackers to inject arbitrary web script or HTML via the xmlcontrol parameter to the default URI. NOTE: some of these details are obtained from third party information.
Affected
1 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| sitecore | cms | <= 7.0 | — |
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
No detection rules found.
Nuclei
Sitecore CMS - Cross-Site Scripting
nuclei·CVSS 4.3
CVE-2014-100004 [MEDIUM] Sitecore CMS - Cross-Site Scripting
Sitecore CMS - Cross-Site Scripting
Sitecore CMS contains a cross-site scripting vulnerability via the "special way" of displaying XML Controls directly, which allows for a Cross Site Scripting Attack.
Template:
id: CVE-2014-100004
info:
name: Sitecore CMS - Cross-Site Scripting
author: DhiyaneshDK
severity: medium
description: |
Sitecore CMS contains a cross-site scripting vulnerability via the "special way" of displaying XML Controls directly, which allows for a Cross Site Scripting Attack.
impact: |
Attackers can execute arbitrary JavaScript in victims' browsers, potentially stealing session cookies, credentials, or performing actions on behalf of users.
remediation: |
Update to a patched version of Sitecore CMS or apply vendor security updates.
reference:
- https://vulners.com/secu
http://osvdb.org/102660http://secunia.com/advisories/56705http://sitecorekh.blogspot.dk/2014/01/sitecore-releases-70-update-4-rev-140120.htmlhttp://www.securityfocus.com/archive/1/530901/100/0/threadedhttp://www.securityfocus.com/bid/65254https://exchange.xforce.ibmcloud.com/vulnerabilities/90833http://osvdb.org/102660http://secunia.com/advisories/56705http://sitecorekh.blogspot.dk/2014/01/sitecore-releases-70-update-4-rev-140120.htmlhttp://www.securityfocus.com/archive/1/530901/100/0/threadedhttp://www.securityfocus.com/bid/65254https://exchange.xforce.ibmcloud.com/vulnerabilities/90833
2015-01-13
Published