CVE-2014-1869: XSS
Common Vulnerabilities and Exposures assigned an identifier CVE-2014-1869 to the following vulnerability:
Name: CVE-2014-1869 URL: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-1869 Assigned: 20140206 Reference: https://github.com/zeroclipboard/zeroclipboard/commit/2f9eb9750a433965572d047e24b0fc78fd1415ca Reference: https://github.com/zeroclipboard/zeroclipboard/pull/335 Reference: https://github.com/zeroclipboard/zeroclipboard/releases/tag/v1.3.2
Multiple cross-site scripting (XSS) vulnerabilities in ZeroClipboard.swf in ZeroClipboard before 1.3.2, as maintained by Jon Rohan and James M. Greene, allow remote attackers to inject arbitrary web script or HTML via vectors related to certain SWF query parameters (aka loaderInfo.parameters).
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
zeroclipboardto a version that resolves this vulnerability.Fixed in 1.3.2Patch CVE-2014-1869
Event History
Frequently Asked Questions
What is the severity of CVE-2014-1869?
CVE-2014-1869 has been assigned a moderate severity rating due to potential risks associated with its exploitation.
How do I fix CVE-2014-1869?
To remediate CVE-2014-1869, update Red Hat OpenShift to a version higher than 3.1 or apply patches as recommended by the vendor.
What software is affected by CVE-2014-1869?
CVE-2014-1869 affects multiple versions of Red Hat OpenShift and specific versions of ZeroClipboard including 1.0.5 through 1.3.1.
What are the impacts of exploiting CVE-2014-1869?
Exploiting CVE-2014-1869 could allow unauthorized access to sensitive data or functionality within affected applications.
Is there a workaround for CVE-2014-1869?
A temporary workaround for CVE-2014-1869 is to disable the affected components until a proper patch can be applied.