CVE-2014-5106: XSS
First published: Mon Jul 28 2014(Updated: )
Cross-site scripting (XSS) vulnerability in Invision Power IP.Board (aka IPB or Power Board) 3.4.x through 3.4.6 allows remote attackers to inject arbitrary web script or HTML via the HTTP Referer header to admin/install/index.php.
Credit: cve@mitre.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Invision Community | =3.4.0 | |
| Invision Community | =3.4.0-alpha1 | |
| Invision Community | =3.4.0-beta1 | |
| Invision Community | =3.4.0-beta2 | |
| Invision Community | =3.4.0-beta3 | |
| Invision Community | =3.4.0-beta4 | |
| Invision Community | =3.4.0-beta5 | |
| Invision Community | =3.4.1 | |
| Invision Community | =3.4.2 | |
| Invision Community | =3.4.3 | |
| Invision Community | =3.4.4 | |
| Invision Community | =3.4.5 | |
| Invision Community | =3.4.6 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the severity of CVE-2014-5106?
CVE-2014-5106 has a medium severity rating due to its potential to allow remote attackers to inject malicious scripts.
How do I fix CVE-2014-5106?
To fix CVE-2014-5106, upgrade Invision Power Board to a version later than 3.4.6.
What versions of Invision Power Board are affected by CVE-2014-5106?
CVE-2014-5106 affects Invision Power Board versions 3.4.0 through 3.4.6.
What type of vulnerability is CVE-2014-5106?
CVE-2014-5106 is a cross-site scripting (XSS) vulnerability.
Can CVE-2014-5106 be exploited through user input?
Yes, CVE-2014-5106 can be exploited via injection through the HTTP Referer header.
- agent/type
- collector/mitre-cve
- source/MITRE
- agent/references
- agent/author
- agent/severity
- agent/last-modified-date
- agent/first-publish-date
- agent/description
- agent/event
- agent/source
- agent/weakness
- agent/tags
- agent/softwarecombine
- collector/nvd-index
- agent/software-canonical-lookup-request
- vendor/invisioncommunity
- canonical/invision community
- version/invision community/3.4.0
- version/invision community/3.4.0-alpha1
- version/invision community/3.4.0-beta1
- version/invision community/3.4.0-beta2
- version/invision community/3.4.0-beta3
- version/invision community/3.4.0-beta4
- version/invision community/3.4.0-beta5
- version/invision community/3.4.1
- version/invision community/3.4.2
- version/invision community/3.4.3
- version/invision community/3.4.4
- version/invision community/3.4.5
- version/invision community/3.4.6