CVE-2014-2091: XSS

Published Mar 2, 2014

Updated

Cross-site scripting (XSS) vulnerability in mods/standard/forums/admin/forumadd.php in ATutor 2.1.1 allows remote authenticated administrators to inject arbitrary web script or HTML via the title parameter in an addforum action. NOTE: the original disclosure also reported issues that may not cross privilege boundaries.

Affected Software

1 affected component

ATutor ATutor=2.1.1

Event History

Mar 2, 2014

CVE Published

via MITRE·05:00 PM

Data Sourced

via MITRE·05:00 PM

Description

Data Sourced

via NVD·05:55 PM

DescriptionSeverityWeaknessAffected Software

Frequently Asked Questions

What is the severity of CVE-2014-2091?

The severity of CVE-2014-2091 is considered medium due to its potential for cross-site scripting attacks.

How do I fix CVE-2014-2091?

To fix CVE-2014-2091, ensure that you upgrade to a patched version of ATutor or implement proper input validation and output encoding on the title parameter.

Who is affected by CVE-2014-2091?

CVE-2014-2091 affects ATutor version 2.1.1 users, specifically those with remote authenticated administrator access.

What types of attacks can CVE-2014-2091 facilitate?

CVE-2014-2091 can facilitate cross-site scripting (XSS) attacks, allowing the injection of arbitrary web scripts or HTML.

Is there a workaround for CVE-2014-2091?

While the best solution is to upgrade, a temporary workaround is to restrict administrator access or sanitize input in the title parameter.