CVE-2014-8377: XSS

Published Oct 21, 2014

Updated

Cross-site scripting (XSS) vulnerability in Webasyst Shop-Script 5.2.2.30933 allows remote attackers to inject arbitrary web script or HTML via the phone number field in a new contact to phpecom/index.php/webasyst/contacts/.

Affected Software

1 affected component

Webasyst Shop-Script=5.2.2.30933

Event History

Oct 21, 2014

CVE Published

via MITRE·03:00 PM

Data Sourced

via MITRE·03:00 PM

Description

Frequently Asked Questions

What access does an attacker need to exploit this issue?

No authentication is required. A remote attacker can inject script or HTML through the phone number field when creating a new contact.

Which deployments are known to be affected?

The reported affected product is Webasyst Shop-Script version 5.2.2.30933. The available data does not identify other affected or fixed versions.

What is the likely impact of successful exploitation?

The vulnerability allows arbitrary web script or HTML injection, which can affect the integrity of pages viewed in the affected application. The provided severity vector does not indicate a direct confidentiality or availability impact.

CVE-2014-8377: XSS

Affected Software

Event History

Frequently Asked Questions

What access does an attacker need to exploit this issue?

Which deployments are known to be affected?

What is the likely impact of successful exploitation?

Company

Resources

Contact

Frequently Asked Questions

What access does an attacker need to exploit this issue?

Which deployments are known to be affected?

What is the likely impact of successful exploitation?