Multiple Cross-Site Scripting Vulnerabilities in Netsweeper Software
CVE-2014-9606

6.1MEDIUM

Key Information:

Vendor

Netsweeper

Status
Netsweeper
Vendor
CVE Published:
19 February 2020

What is CVE-2014-9606?

Netsweeper contains multiple cross-site scripting (XSS) vulnerabilities that impact versions prior to 3.1.10, 4.0.9, and 4.1.2. These vulnerabilities allow remote attackers to inject arbitrary web scripts or HTML into affected endpoints, including parameters like 'server' in remotereporter/load_logfiles.php and 'customctid' in webadmin/policy/category_table_ajax.php. Exploitation may lead to unauthorized access and data breaches, emphasizing the need for immediate updates to secure the software.

References

http://packetstormsecurity.com/files/133034/Netsweeper-By...
x_refsource_MISC

CVSS V3.1

Score:
6.1
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.