CVE-2013-2643: XSS
First published: Tue Mar 18 2014(Updated: )
Multiple cross-site scripting (XSS) vulnerabilities in Sophos Web Appliance before 3.7.8.2 allow remote attackers to inject arbitrary web script or HTML via the (1) xss parameter in an allow action to rss.php, (2) msg parameter to end-user/errdoc.php, (3) h parameter to end-user/ftp_redirect.php, or (4) threat parameter to the Blocked component.
Credit: cve@mitre.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Sophos Web Appliance Firmware | <=3.7.8.1 | |
| Sophos Web Appliance Firmware |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the severity of CVE-2013-2643?
CVE-2013-2643 is classified as a moderate severity vulnerability due to its potential for cross-site scripting attacks.
How do I fix CVE-2013-2643?
To fix CVE-2013-2643, update the Sophos Web Appliance to version 3.7.8.2 or later.
What types of vulnerabilities are present in CVE-2013-2643?
CVE-2013-2643 contains multiple cross-site scripting (XSS) vulnerabilities.
Who is affected by CVE-2013-2643?
CVE-2013-2643 affects versions of Sophos Web Appliance firmware prior to 3.7.8.2.
What attack vector does CVE-2013-2643 use?
CVE-2013-2643 can be exploited through the injection of arbitrary web scripts or HTML via specific parameters in the application.
- agent/references
- agent/type
- agent/softwarecombine
- collector/mitre-cve
- source/MITRE
- agent/weakness
- agent/author
- agent/last-modified-date
- agent/severity
- agent/description
- agent/first-publish-date
- agent/event
- agent/source
- agent/tags
- collector/nvd-index
- agent/software-canonical-lookup-request
- vendor/sophos
- canonical/sophos web appliance firmware
- version/sophos web appliance firmware/3.7.8.1