Vulnerability Details : CVE-2014-9711
Potential exploit
Multiple cross-site scripting (XSS) vulnerabilities in the Investigative Reports in Websense TRITON AP-WEB before 8.0.0 and Web Security and Filter, Web Security Gateway, and Web Security Gateway Anywhere 7.8.3 before Hotfix 02 and 7.8.4 before Hotfix 01 allow remote attackers to inject arbitrary web script or HTML via the (1) ReportName (Job Name) parameter to the Explorer report scheduler (cgi-bin/WsCgiExplorerSchedule.exe) in the Job Queue or the col parameter to the (2) Names or (3) Anonymous (explorer_wse/explorer_anon.exe) summary report page.
Vulnerability category: Cross site scripting (XSS)
Products affected by CVE-2014-9711
- cpe:2.3:a:websense:triton_web_filter:*:*:*:*:*:*:*:*
- cpe:2.3:a:websense:triton_web_security:*:*:*:*:*:*:*:*
- cpe:2.3:a:websense:triton_web_security_gateway:*:*:*:*:*:*:*:*
- cpe:2.3:a:websense:triton_web_security_gateway_anywhere:*:*:*:*:*:*:*:*
- cpe:2.3:a:websense:triton_ap_web:*:*:*:*:*:*:*:*
Exploit prediction scoring system (EPSS) score for CVE-2014-9711
0.68%
Probability of exploitation activity in the next 30 days
EPSS Score History
~ 80 %
Percentile, the proportion of vulnerabilities that are scored at or less
CVSS scores for CVE-2014-9711
Base Score | Base Severity | CVSS Vector | Exploitability Score | Impact Score | Score Source | First Seen |
---|---|---|---|---|---|---|
4.3
|
MEDIUM | AV:N/AC:M/Au:N/C:N/I:P/A:N |
8.6
|
2.9
|
NIST |
CWE ids for CVE-2014-9711
-
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.Assigned by: nvd@nist.gov (Primary)
References for CVE-2014-9711
-
http://www.websense.com/support/article/kbarticle/v7-8-3-About-Hotfix-02-for-Web-Security-Solutions
My Account Registration — Websense.comVendor Advisory
-
http://packetstormsecurity.com/files/130905/Websense-Reporting-Cross-Site-Scripting.html
Websense Reporting Cross Site Scripting ≈ Packet StormExploit
-
http://www.websense.com/support/article/kbarticle/v7-8-4-About-Hotfix-01-for-Web-Security-Solutions
My Account Registration — Websense.comVendor Advisory
-
https://www.securify.nl/advisory/SFY20140914/multiple_cross_site_scripting_vulnerabilities_in_websense_reporting.html
Multiple Cross-Site Scripting vulnerabilities in Websense Reporting - Security Advisories and Insights - Securify B.V.Exploit
-
http://seclists.org/fulldisclosure/2015/Mar/110
Full Disclosure: Multiple Cross-Site Scripting vulnerabilities in Websense Reporting
-
http://www.securityfocus.com/archive/1/534915/100/0/threaded
SecurityFocus
-
http://packetstormsecurity.com/files/130903/Websense-Explorer-Report-Scheduler-Cross-Site-Scripting.html
Websense Explorer Report Scheduler Cross Site Scripting ≈ Packet StormExploit
-
http://www.websense.com/support/article/kbarticle/Vulnerabilities-resolved-in-TRITON-APX-Version-8-0
KB Article | Forcepoint SupportVendor Advisory
-
http://seclists.org/fulldisclosure/2015/Mar/109
Full Disclosure: Cross-Site Scripting vulnerability in Websense Explorer report scheduler
-
http://www.securityfocus.com/archive/1/534917/100/0/threaded
SecurityFocus
-
https://www.securify.nl/advisory/SFY20140911/cross_site_scripting_vulnerability_in_websense_explorer_report_scheduler.html
Cross-Site Scripting vulnerability in Websense Explorer report scheduler - Security Advisories and Insights - Securify B.V.Exploit
Jump to