CVE-2014-5106 : Cross-site scripting (XSS) vulnerability in Invision Power IP.Board (aka IPB or

Cross-site scripting (XSS) vulnerability in Invision Power IP.Board (aka IPB or Power Board) 3.4.x through 3.4.6 allows remote attackers to inject arbitrary web script or HTML via the HTTP Referer header to admin/install/index.php.

Published 2014-07-28 15:55:04

Updated 2020-06-03 14:54:57

Source MITRE

View at NVD, CVE.org

Vulnerability category: Cross site scripting (XSS)

Products affected by CVE-2014-5106

Invisioncommunity » Invision Power Board » Version: 3.4.0 Update Alpha1
cpe:2.3:a:invisioncommunity:invision_power_board:3.4.0:alpha1:*:*:*:*:*:*
Matching versions
Invisioncommunity » Invision Power Board » Version: 3.4.1
cpe:2.3:a:invisioncommunity:invision_power_board:3.4.1:*:*:*:*:*:*:*
Matching versions
Invisioncommunity » Invision Power Board » Version: 3.4.2
cpe:2.3:a:invisioncommunity:invision_power_board:3.4.2:*:*:*:*:*:*:*
Matching versions
Invisioncommunity » Invision Power Board » Version: 3.4.0 Update Beta1
cpe:2.3:a:invisioncommunity:invision_power_board:3.4.0:beta1:*:*:*:*:*:*
Matching versions
Invisioncommunity » Invision Power Board » Version: 3.4.0 Update Beta2
cpe:2.3:a:invisioncommunity:invision_power_board:3.4.0:beta2:*:*:*:*:*:*
Matching versions
Invisioncommunity » Invision Power Board » Version: 3.4.3
cpe:2.3:a:invisioncommunity:invision_power_board:3.4.3:*:*:*:*:*:*:*
Matching versions
Invisioncommunity » Invision Power Board » Version: 3.4.4
cpe:2.3:a:invisioncommunity:invision_power_board:3.4.4:*:*:*:*:*:*:*
Matching versions
Invisioncommunity » Invision Power Board » Version: 3.4.0 Update Beta5
cpe:2.3:a:invisioncommunity:invision_power_board:3.4.0:beta5:*:*:*:*:*:*
Matching versions
Invisioncommunity » Invision Power Board » Version: 3.4.0
cpe:2.3:a:invisioncommunity:invision_power_board:3.4.0:*:*:*:*:*:*:*
Matching versions
Invisioncommunity » Invision Power Board » Version: 3.4.0 Update Beta3
cpe:2.3:a:invisioncommunity:invision_power_board:3.4.0:beta3:*:*:*:*:*:*
Matching versions
Invisioncommunity » Invision Power Board » Version: 3.4.0 Update Beta4
cpe:2.3:a:invisioncommunity:invision_power_board:3.4.0:beta4:*:*:*:*:*:*
Matching versions
Invisioncommunity » Invision Power Board » Version: 3.4.5
cpe:2.3:a:invisioncommunity:invision_power_board:3.4.5:*:*:*:*:*:*:*
Matching versions
Invisioncommunity » Invision Power Board » Version: 3.4.6
cpe:2.3:a:invisioncommunity:invision_power_board:3.4.6:*:*:*:*:*:*:*
Matching versions

Exploit prediction scoring system (EPSS) score for CVE-2014-5106

EPSS FAQ

0.19%

Probability of exploitation activity in the next 30 days EPSS Score History

~ 56 %

Percentile, the proportion of vulnerabilities that are scored at or less

CVSS scores for CVE-2014-5106

Base Score	Base Severity	CVSS Vector	Exploitability Score	Impact Score	Score Source	First Seen
4.3	MEDIUM	AV:N/AC:M/Au:N/C:N/I:P/A:N	8.6	2.9	NIST
Access Vector: Network Access Complexity: Medium Authentication: None Confidentiality Impact: None Integrity Impact: Partial Availability Impact: None

CWE ids for CVE-2014-5106

CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Assigned by: nvd@nist.gov (Primary)

References for CVE-2014-5106

http://www.securityfocus.com/archive/1/532822/100/0/threaded

SecurityFocus
http://www.securityfocus.com/bid/68705

IP.Board Cross Site Scripting Vulnerability
https://exchange.xforce.ibmcloud.com/vulnerabilities/94693

IP.Board index.php cross-site scripting CVE-2014-5106 Vulnerability Report

Jump to

Vulnerability Details : CVE-2014-5106

Products affected by CVE-2014-5106

Exploit prediction scoring system (EPSS) score for CVE-2014-5106

CVSS scores for CVE-2014-5106

CWE ids for CVE-2014-5106

References for CVE-2014-5106