CVE-2014-1427 — Cross-site Scripting in Maas

CWE-79 — Cross-site Scripting6 documents5 sources
Severity
6.1MEDIUMNVD
CNA9.6
EPSS
0.4%
top 40.35%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
Ubuntu MaasCanonical Metal AS A Service
Timeline
PublishedApr 22
Latest updateMay 17

Description

A vulnerability in the REST API of Ubuntu MAAS allows an attacker to cause a logged-in user to execute commands via cross-site scripting. This issue affects MAAS versions prior to 1.9.2.

CVSS vector

CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:NExploitability: 2.8 | Impact: 2.7

Affected Packages3 packages

▶CVEListV5ubuntu/maasunspecified — 1.9.2
▶Ubuntuubuntu/maas< 1.9.5+bzr4599-0ubuntu1~14.04.1+1

🔴Vulnerability Details

3
GHSA
GHSA-r5fr-m3x2-j65q: A vulnerability in the REST API of Ubuntu MAAS allows an attacker to cause a logged-in user to execute commands via cross-site scripting↗2022-05-17
▶
CVEList
MAAS API vulnerable to CSRF attack↗2019-04-22
▶
OSV
CVE-2014-1427: A vulnerability in the REST API of Ubuntu MAAS allows an attacker to cause a logged-in user to execute commands via cross-site scripting↗2019-04-22
▶