CVE-2014-0335: XSS

Published Mar 6, 2014

Updated

Multiple cross-site scripting (XSS) vulnerabilities in the web client in Serena Dimensions CM 12.2 build 7.199.0 allow remote attackers to inject arbitrary web script or HTML via the (1) DBCONN, (2) DBNAME, (3) DMHOST, (4) MANDBNAME, (5) framecmd, (6) identifier, (7) merant.adm.adapters.AdmDialogPropertyMgr, (8) navframe, (9) navjsp, (10) targetframe, (11) id, or (12) type parameter to the dimensions/ URI.

Affected Software

1 affected component

Serena Dimensions CM=12.2-build7.199.0

Event History

Mar 6, 2014

CVE Published

via MITRE·11:00 AM

Data Sourced

via MITRE·11:00 AM

Description

Data Sourced

via NVD·11:55 AM

DescriptionSeverityWeaknessAffected Software

Frequently Asked Questions

What is the severity of CVE-2014-0335?

CVE-2014-0335 is considered a medium severity vulnerability due to its potential for exploitation through cross-site scripting.

How do I fix CVE-2014-0335?

To fix CVE-2014-0335, update to a patched version of Serena Dimensions CM that addresses these XSS vulnerabilities.

What software is affected by CVE-2014-0335?

CVE-2014-0335 specifically affects Serena Dimensions CM version 12.2 build 7.199.0.

Can CVE-2014-0335 be exploited remotely?

Yes, CVE-2014-0335 allows remote attackers to inject arbitrary web scripts or HTML, making exploitation possible.

What types of attacks are possible with CVE-2014-0335?

CVE-2014-0335 enables cross-site scripting (XSS) attacks that can lead to session hijacking or data theft.