CVE-2014-4965: XSS
Multiple cross-site scripting (XSS) vulnerabilities in Shopizer 1.1.5 and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) customername parameter to central/orders/searchcriteria.action; (2) productname, (3) availability, or (4) status parameter to central/catalog/productlist.action; or unspecified vectors in (5) WebContent/orders/orderlist.jsp.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2014-4965?
CVE-2014-4965 is considered a medium severity vulnerability due to its potential for exploitation via cross-site scripting.
How do I fix CVE-2014-4965?
To fix CVE-2014-4965, upgrade to a version of Shopizer later than 1.1.5 that addresses these vulnerabilities.
What types of parameters are affected by CVE-2014-4965?
CVE-2014-4965 affects parameters including customername, productname, availability, and status.
Who can exploit CVE-2014-4965?
Remote attackers can exploit CVE-2014-4965 to inject arbitrary web scripts or HTML.
Which versions of Shopizer are vulnerable to CVE-2014-4965?
Shopizer versions 1.1.5 and earlier are vulnerable to CVE-2014-4965.