CVE-2014-5326
Aliases:GHSA-q5v2-2v66-6hwm
Advisory lineage Upstream: 0 Downstream: 3
Modified
Published: 24 Nov 2014, 02:00
Last modified:06 Aug 2024, 11:41
Vulnerability Summary
Overall Risk (default)
low
17/100 CVSS Score
4.3 MEDIUM
v2.0 (nvd)
EPSS Score
0.22% LOW
0% probability 0.00%
KEV
Not listed
Ransomware
No reports
Public exploits
None found
Dark Web
Not detected
Timeline
24 Nov 2014, 02:00
Published
Vulnerability first disclosed
06 Aug 2024, 11:41
Last Modified
Vulnerability information updated
Description
Cross-site scripting (XSS) vulnerability in Direct Web Remoting (DWR) through 2.0.10 and 3.x through 3.0.RC2 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVSS Metrics
- v2.0•MEDIUM•Score: 4.3AV:N/AC:M/Au:N/C:N/I:P/A:N
EPSS Trends
Current EPSS score: 0.22%• Percentile: 44%
Techniques & Countermeasures
- CWE-79•Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Affected Systems
- directwebremoting•direct_web_remoting
≤ 2.0.10 | 3.0:rc1 | 3.0:rc2
- org.directwebremoting•dwr
< 2.0.11 | ≥ 3.0.M1, < 3.0.RC3