CVE-2014-2385 : Multiple cross-site scripting (XSS) vulnerabilities in the web UI in Sophos Anti

Multiple cross-site scripting (XSS) vulnerabilities in the web UI in Sophos Anti-Virus for Linux before 9.6.1 allow local users to inject arbitrary web script or HTML via the (1) newListList:ExcludeFileOnExpression, (2) newListList:ExcludeFilesystems, or (3) newListList:ExcludeMountPaths parameter to exclusion/configure or (4) text:EmailServer or (5) newListList:Email parameter to notification/configure.

Published 2014-07-22 14:55:09

Updated 2018-10-09 19:43:15

Source MITRE

View at NVD, CVE.org

Vulnerability category: Cross site scripting (XSS)

Products affected by CVE-2014-2385

Sophos » Anti-virus » For Linux Kernel
Versions up to, including, (<=) 9.5.1
cpe:2.3:a:sophos:anti-virus:*:*:*:*:*:linux_kernel:*:*
Matching versions

Exploit prediction scoring system (EPSS) score for CVE-2014-2385

EPSS FAQ

0.22%

Probability of exploitation activity in the next 30 days EPSS Score History

~ 60 %

Percentile, the proportion of vulnerabilities that are scored at or less

CVSS scores for CVE-2014-2385

Base Score	Base Severity	CVSS Vector	Exploitability Score	Impact Score	Score Source	First Seen
4.3	MEDIUM	AV:N/AC:M/Au:N/C:N/I:P/A:N	8.6	2.9	NIST
Access Vector: Network Access Complexity: Medium Authentication: None Confidentiality Impact: None Integrity Impact: Partial Availability Impact: None

CWE ids for CVE-2014-2385

CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Assigned by: nvd@nist.gov (Primary)

References for CVE-2014-2385

http://www.securityfocus.com/archive/1/532558/100/0/threaded

SecurityFocus
http://seclists.org/fulldisclosure/2014/Jun/126

Full Disclosure: CVE-2014-2385 - Multiple Cross Site Scripting in Sophos Antivirus Configuration Console (Linux)
Exploit
http://www.sophos.com/en-us/support/knowledgebase/121135.aspx

Sophos Community
Vendor Advisory
https://www.portcullis-security.com/security-research-and-downloads/security-advisories/cve-2014-2385/

CVE-2014-2385 - Portcullis
Exploit
http://www.securitytracker.com/id/1030467

Sophos Anti-Virus Input Validation Flaw in Configuration Console Permits Cross-Site Scripting Attacks - SecurityTracker
http://packetstormsecurity.com/files/127228/Sophos-Antivirus-9.5.1-Cross-Site-Scripting.html

Sophos Antivirus 9.5.1 Cross Site Scripting ≈ Packet Storm

Jump to

Vulnerability Details : CVE-2014-2385

Products affected by CVE-2014-2385

Exploit prediction scoring system (EPSS) score for CVE-2014-2385

CVSS scores for CVE-2014-2385

CWE ids for CVE-2014-2385

References for CVE-2014-2385