CVE-2014-9606: XSS
Multiple cross-site scripting (XSS) vulnerabilities in Netsweeper before 3.1.10, 4.0.x before 4.0.9, and 4.1.x before 4.1.2 allow remote attackers to inject arbitrary web script or HTML via the (1) server parameter to remotereporter/loadlogfiles.php, (2) customctid parameter to webadmin/policy/categorytableajax.php, (3) urllist parameter to webadmin/alert/alert.php, (4) QUERYSTRING to webadmin/ajaxfilemanager/ajaxgetfilelisting.php, or (5) PATHINFO to webadmin/policy/policytableajax.php/.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2014-9606?
CVE-2014-9606 is considered a high severity vulnerability due to its potential for exploitation via arbitrary script injection.
How do I fix CVE-2014-9606?
To fix CVE-2014-9606, upgrade to Netsweeper version 3.1.10, 4.0.9, or 4.1.2 or later, which addresses the cross-site scripting vulnerabilities.
What versions of Netsweeper are affected by CVE-2014-9606?
Netsweeper versions before 3.1.10, 4.0.x before 4.0.9, and 4.1.x before 4.1.2 are affected by CVE-2014-9606.
What types of attacks are possible due to CVE-2014-9606?
CVE-2014-9606 allows remote attackers to inject arbitrary web scripts or HTML, potentially leading to user data theft or session hijacking.
Is there a workaround for CVE-2014-9606 until I can upgrade?
There are no official workarounds for CVE-2014-9606; upgrading to a patched version is recommended as the best mitigation strategy.