CVE-2014-3988: XSS
Published Dec 3, 2014
·Updated
Cross-site scripting (XSS) vulnerability in index.php in SunHater KCFinder 3.11 and earlier allows remote attackers to inject arbitrary web script or HTML via (1) file or (2) directory (folder) name of an uploaded file.
Affected Software
1 affected component
SunHater KCFinder<=3.11
Event History
Dec 3, 2014
CVE Published
via MITRE·01:00 AM
Data Sourced
via MITRE·01:00 AM
Description
Frequently Asked Questions
1
What is the severity of CVE-2014-3988?
CVE-2014-3988 is classified as a medium severity cross-site scripting (XSS) vulnerability.
2
How do I fix CVE-2014-3988?
To fix CVE-2014-3988, upgrade to KCFinder version 3.12 or later where the vulnerability has been addressed.
3
What software is affected by CVE-2014-3988?
CVE-2014-3988 affects KCFinder version 3.11 and earlier.
4
What type of attack does CVE-2014-3988 enable?
CVE-2014-3988 enables remote attackers to perform cross-site scripting (XSS) attacks.
5
What specific inputs are vulnerable in CVE-2014-3988?
In CVE-2014-3988, the vulnerable inputs are the file or directory names of uploaded files.