CVE-2014-4853: XSS
Published Jul 10, 2014
·Updated
Cross-site scripting (XSS) vulnerability in odm-init.php in OpenDocMan before 1.2.7.3 allows remote authenticated users to inject arbitrary web script or HTML via the file name of an uploaded file.
Affected Software
13 affected components
OpenDocMan OpenDocMan<=1.2.7.2
OpenDocMan OpenDocMan=1.2.6.2
OpenDocMan OpenDocMan=1.2.6.2-a
OpenDocMan OpenDocMan=1.2.6.2-b
OpenDocMan OpenDocMan=1.2.6.3
OpenDocMan OpenDocMan=1.2.6.3-a
OpenDocMan OpenDocMan=1.2.6.5
OpenDocMan OpenDocMan=1.2.6.6
OpenDocMan OpenDocMan=1.2.6.7
OpenDocMan OpenDocMan=1.2.6.7-beta
OpenDocMan OpenDocMan=1.2.6.8
OpenDocMan OpenDocMan=1.2.7
OpenDocMan OpenDocMan=1.2.7.1
Remediation
Event History
Jul 10, 2014
CVE Published
via MITRE·04:00 PM
Data Sourced
via MITRE·04:00 PM
Description
Frequently Asked Questions
1
What is the severity of CVE-2014-4853?
The severity of CVE-2014-4853 is considered to be moderate due to its potential for cross-site scripting attacks.
2
How do I fix CVE-2014-4853?
To fix CVE-2014-4853, upgrade OpenDocMan to version 1.2.7.3 or later.
3
Who is affected by CVE-2014-4853?
Users of OpenDocMan versions prior to 1.2.7.3 are affected by CVE-2014-4853.
4
What impact does CVE-2014-4853 have?
CVE-2014-4853 allows remote authenticated users to inject arbitrary web script or HTML via the file name of an uploaded file.
5
Does CVE-2014-4853 require authentication to exploit?
Yes, CVE-2014-4853 requires an attacker to be an authenticated user to exploit the vulnerability.