CVE-2014-2965 : Cross-site scripting (XSS) vulnerability in auth-settings-x.php in SpamTitan bef

Cross-site scripting (XSS) vulnerability in auth-settings-x.php in SpamTitan before 6.04 allows remote attackers to inject arbitrary web script or HTML via the sortdir parameter.

Published 2014-07-03 14:55:07

Updated 2014-07-17 05:06:39

Source CERT/CC

View at NVD, CVE.org

Vulnerability category: Cross site scripting (XSS)

Products affected by CVE-2014-2965

Spamtitan » Spamtitan
Versions up to, including, (<=) 6.03
cpe:2.3:a:spamtitan:spamtitan:*:*:*:*:*:*:*:*
Matching versions
Spamtitan » Spamtitan » Version: 6.01
cpe:2.3:a:spamtitan:spamtitan:6.01:*:*:*:*:*:*:*
Matching versions
Spamtitan » Spamtitan » Version: 5.07
cpe:2.3:a:spamtitan:spamtitan:5.07:*:*:*:*:*:*:*
Matching versions
Spamtitan » Spamtitan » Version: 5.06
cpe:2.3:a:spamtitan:spamtitan:5.06:*:*:*:*:*:*:*
Matching versions
Spamtitan » Spamtitan » Version: 6.00
cpe:2.3:a:spamtitan:spamtitan:6.00:*:*:*:*:*:*:*
Matching versions
Spamtitan » Spamtitan » Version: 5.13
cpe:2.3:a:spamtitan:spamtitan:5.13:*:*:*:*:*:*:*
Matching versions
Spamtitan » Spamtitan » Version: 5.05
cpe:2.3:a:spamtitan:spamtitan:5.05:*:*:*:*:*:*:*
Matching versions
Spamtitan » Spamtitan » Version: 5.04
cpe:2.3:a:spamtitan:spamtitan:5.04:*:*:*:*:*:*:*
Matching versions
Spamtitan » Spamtitan » Version: 5.10
cpe:2.3:a:spamtitan:spamtitan:5.10:*:*:*:*:*:*:*
Matching versions
Spamtitan » Spamtitan » Version: 5.08
cpe:2.3:a:spamtitan:spamtitan:5.08:*:*:*:*:*:*:*
Matching versions
Spamtitan » Spamtitan » Version: 5.12
cpe:2.3:a:spamtitan:spamtitan:5.12:*:*:*:*:*:*:*
Matching versions
Spamtitan » Spamtitan » Version: 5.11
cpe:2.3:a:spamtitan:spamtitan:5.11:*:*:*:*:*:*:*
Matching versions

Exploit prediction scoring system (EPSS) score for CVE-2014-2965

EPSS FAQ

0.26%

Probability of exploitation activity in the next 30 days EPSS Score History

~ 66 %

Percentile, the proportion of vulnerabilities that are scored at or less

CVSS scores for CVE-2014-2965

Base Score	Base Severity	CVSS Vector	Exploitability Score	Impact Score	Score Source	First Seen
4.3	MEDIUM	AV:N/AC:M/Au:N/C:N/I:P/A:N	8.6	2.9	NIST
Access Vector: Network Access Complexity: Medium Authentication: None Confidentiality Impact: None Integrity Impact: Partial Availability Impact: None

CWE ids for CVE-2014-2965

CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Assigned by: nvd@nist.gov (Primary)

References for CVE-2014-2965

http://seclists.org/fulldisclosure/2014/Jun/113

Full Disclosure: SpamTitan contains a reflected cross-site scripting (XSS) vulnerability CVE-2014-2965
http://www.securityfocus.com/bid/68143

SpamTitan 'auth-settings-x.php' Cross Site Scripting Vulnerability
http://packetstormsecurity.com/files/127184/SpamTitan-6.01-Cross-Site-Scripting.html

SpamTitan 6.01 Cross Site Scripting ≈ Packet Storm
http://www.kb.cert.org/vuls/id/849500

VU#849500 - SpamTitan contains a reflected cross-site scripting (XSS) vulnerability
Third Party Advisory;US Government Resource

Jump to

Vulnerability Details : CVE-2014-2965

Products affected by CVE-2014-2965

Exploit prediction scoring system (EPSS) score for CVE-2014-2965

CVSS scores for CVE-2014-2965

CWE ids for CVE-2014-2965

References for CVE-2014-2965