CVE-2014-3922: XSS
First published: Fri May 30 2014(Updated: )
Cross-site scripting (XSS) vulnerability in Trend Micro InterScan Messaging Security Virtual Appliance 8.5.1.1516 allows remote authenticated users to inject arbitrary web script or HTML via the addWhiteListDomainStr parameter to addWhiteListDomain.imss.
Credit: cve@mitre.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Trend Micro InterScan Messaging Security Virtual Appliance | =8.5.1.1516 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- http://packetstormsecurity.com/files/126847/InterScan-Messaging-Security-Virtual-Appliance-8.5.1.1516-Cross-Site-Scripting.html
- http://seclists.org/fulldisclosure/2014/May/164
- http://secunia.com/advisories/58491
- http://www.securityfocus.com/bid/67726
- http://www.securitytracker.com/id/1030318
- https://vimeo.com/96757096
Frequently Asked Questions
What is the severity of CVE-2014-3922?
CVE-2014-3922 is classified as a medium severity vulnerability due to its potential impact on user data.
How do I fix CVE-2014-3922?
To mitigate CVE-2014-3922, update Trend Micro InterScan Messaging Security Virtual Appliance to a version that does not contain this vulnerability.
Who is affected by CVE-2014-3922?
CVE-2014-3922 affects remote authenticated users of Trend Micro InterScan Messaging Security Virtual Appliance version 8.5.1.1516.
What type of vulnerability is CVE-2014-3922?
CVE-2014-3922 is a cross-site scripting (XSS) vulnerability that allows injection of arbitrary web scripts or HTML.
What parameter is exploited in CVE-2014-3922?
The vulnerability in CVE-2014-3922 is exploited through the addWhiteListDomainStr parameter in the addWhiteListDomain.imss functionality.
- agent/references
- agent/type
- agent/softwarecombine
- collector/mitre-cve
- source/MITRE
- agent/severity
- agent/author
- agent/last-modified-date
- agent/description
- agent/first-publish-date
- agent/event
- agent/source
- agent/tags
- collector/nvd-index
- agent/software-canonical-lookup-request
- agent/weakness
- vendor/trendmicro
- canonical/trend micro interscan messaging security virtual appliance
- version/trend micro interscan messaging security virtual appliance/8.5.1.1516