CVE-2014-5391: XSS
First published: Thu Sep 11 2014(Updated: )
Cross-site scripting (XSS) vulnerability in the JobScheduler Operations Center (JOC) in SOS JobScheduler before 1.6.4246 and 1.7.x before 1.7.4241 allows remote attackers to inject arbitrary web script or HTML via the hash property (location.hash).
Credit: cve@mitre.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Siemens Operation Scheduler | <=1.6.4131 | |
| Siemens Operation Scheduler | =1.6.4014 | |
| Siemens Operation Scheduler | =1.6.4043 | |
| Siemens Operation Scheduler | =1.7.4177 | |
| Siemens Operation Scheduler | =1.7.4189 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- http://packetstormsecurity.com/files/128180/JobScheduler-Cross-Site-Scripting.html
- http://www.christian-schneider.net/advisories/CVE-2014-5391.txt
- http://www.securityfocus.com/archive/1/533372/100/0/threaded
- http://www.securityfocus.com/bid/69660
- http://www.sos-berlin.com/modules/news/article.php?storyid=73
- http://www.sos-berlin.com/modules/news/article.php?storyid=74
- https://change.sos-berlin.com/browse/JS-1203
- https://exchange.xforce.ibmcloud.com/vulnerabilities/95797
Frequently Asked Questions
What is the severity of CVE-2014-5391?
CVE-2014-5391 is classified as a medium severity cross-site scripting vulnerability.
How do I fix CVE-2014-5391?
To resolve CVE-2014-5391, upgrade your SOS JobScheduler to version 1.6.4246 or higher, or 1.7.4241 or higher.
What versions of SOS JobScheduler are affected by CVE-2014-5391?
CVE-2014-5391 affects SOS JobScheduler versions prior to 1.6.4246 and 1.7.x before 1.7.4241.
Can CVE-2014-5391 allow remote attacks?
Yes, CVE-2014-5391 allows remote attackers to inject arbitrary web scripts or HTML into the application.
What property does CVE-2014-5391 exploit for XSS?
CVE-2014-5391 exploits the hash property (location.hash) to perform cross-site scripting attacks.
- agent/references
- agent/type
- agent/remedy
- agent/softwarecombine
- collector/mitre-cve
- source/MITRE
- agent/author
- agent/severity
- agent/last-modified-date
- agent/description
- agent/first-publish-date
- agent/event
- agent/source
- agent/tags
- collector/nvd-index
- agent/software-canonical-lookup-request
- agent/weakness
- vendor/sos
- canonical/siemens operation scheduler
- version/siemens operation scheduler/1.6.4131
- version/siemens operation scheduler/1.6.4014
- version/siemens operation scheduler/1.6.4043
- version/siemens operation scheduler/1.7.4177
- version/siemens operation scheduler/1.7.4189