CVE-2014-3149: XSS

Published Jul 3, 2014

Updated

Cross-site scripting (XSS) vulnerability in Invision Power IP.Board (aka IPB or Power Board) 3.3.x and 3.4.x through 3.4.6, as downloaded before 20140424, or IP.Nexus 1.5.x through 1.5.9, as downloaded before 20140424, allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.

Affected Software

34 affected components

Invisioncommunity Invision Power Board=3.3.0

Invisioncommunity Invision Power Board=3.3.0-alpha1

Invisioncommunity Invision Power Board=3.3.0-alpha2

Invisioncommunity Invision Power Board=3.3.0-beta1

Invisioncommunity Invision Power Board=3.3.0-beta2

Invisioncommunity Invision Power Board=3.3.0-beta3

Invisioncommunity Invision Power Board=3.3.0-beta4

Invisioncommunity Invision Power Board=3.3.1

Invisioncommunity Invision Power Board=3.3.2

Invisioncommunity Invision Power Board=3.3.3

Invisioncommunity Invision Power Board=3.3.4

Invisioncommunity Invision Power Board=3.4.0

Invisioncommunity Invision Power Board=3.4.0-alpha1

Invisioncommunity Invision Power Board=3.4.0-beta1

Invisioncommunity Invision Power Board=3.4.0-beta2

Invisioncommunity Invision Power Board=3.4.0-beta3

Invisioncommunity Invision Power Board=3.4.0-beta4

Invisioncommunity Invision Power Board=3.4.0-beta5

Invisioncommunity Invision Power Board=3.4.1

Invisioncommunity Invision Power Board=3.4.2

Invisioncommunity Invision Power Board=3.4.3

Invisioncommunity Invision Power Board=3.4.4

Invisioncommunity Invision Power Board=3.4.5

Invisioncommunity Invision Power Board=3.4.6

Invisionpower Ip.nexus=1.5.0

Invisionpower Ip.nexus=1.5.1

Invisionpower Ip.nexus=1.5.2

Invisionpower Ip.nexus=1.5.3

Invisionpower Ip.nexus=1.5.4

Invisionpower Ip.nexus=1.5.5

Invisionpower Ip.nexus=1.5.6

Invisionpower Ip.nexus=1.5.7

Invisionpower Ip.nexus=1.5.8

Invisionpower Ip.nexus=1.5.9

Remediation

Patch Available

http://community.invisionpower.com/topic/399747-ipboard-33x-34x-security-update

Event History

Jul 3, 2014

CVE Published

via MITRE·02:00 PM

Data Sourced

via MITRE·02:00 PM

Description

Frequently Asked Questions

What is the severity of CVE-2014-3149?

CVE-2014-3149 is classified as a medium severity cross-site scripting (XSS) vulnerability.

How do I fix CVE-2014-3149?

To fix CVE-2014-3149, you should upgrade your Invision Power Board or IP.Nexus to the latest versions provided by Invision Community.

What versions are affected by CVE-2014-3149?

CVE-2014-3149 affects Invision Power Board versions 3.3.x and 3.4.x up to 3.4.6, as well as IP.Nexus versions 1.5.x up to 1.5.9.

Can CVE-2014-3149 be exploited remotely?

Yes, CVE-2014-3149 allows remote attackers to inject arbitrary web scripts or HTML due to the vulnerable nature of the application.

What type of vulnerability is CVE-2014-3149?

CVE-2014-3149 is a cross-site scripting (XSS) vulnerability that can lead to unauthorized access or information disclosure.