NVD

Id
30197  
Name
CVE-2014-1573  
Description
Bugzilla 2.x through 4.0.x before 4.0.15, 4.1.x and 4.2.x before 4.2.11, 4.3.x and 4.4.x before 4.4.6, and 4.5.x before 4.5.6 does not ensure that a scalar context is used for certain CGI parameters, which allows remote attackers to conduct cross-site scripting (XSS) attacks by sending three values for a single parameter name.  
Reject
 
CVSS Version
2  
CVSS Score
4.3  
Severity
Medium  
CVSS Base Score
4.3  
CVSS Impact Subscore
2.9  
CVSS Exploit Subscore
8.6  
CVSS Vector
(AV:N/AC:M/Au:N/C:N/I:P/A:N)  
Pub Date
2017-01-19  
Published
2014-10-12  
Modified Date
2016-11-28  
Seq
2014-1573  

Actions

Related NVD References

Id NVD Id NVD No. Reference Actions
159691 30197 CVE-2014-1573 http://advisories.mageia.org/MGASA-2014-0412.html  View
159692 30197 CVE-2014-1573 http://blog.gerv.net/2014/10/new-class-of-vulnerability-in-perl-web-applications/  View
159693 30197 CVE-2014-1573 FEDORA-2014-12591  View
159694 30197 CVE-2014-1573 FEDORA-2014-12584  View
159695 30197 CVE-2014-1573 FEDORA-2014-12530  View
159696 30197 CVE-2014-1573 [oss-security] 20141007 "New Class of Vulnerability in Perl Web Applications"  View
159697 30197 CVE-2014-1573 http://packetstormsecurity.com/files/128578/Bugzilla-Account-Creation-XSS-Information-Leak.html  View
159698 30197 CVE-2014-1573 http://www.bugzilla.org/security/4.0.14/  View
159699 30197 CVE-2014-1573 MDVSA-2014:200  View
159700 30197 CVE-2014-1573 http://www.opennet.ru/opennews/art.shtml?num=40766  View
159701 30197 CVE-2014-1573 http://www.reddit.com/r/netsec/comments/2ihen0/new_class_of_vulnerability_in_perl_web/  View
159702 30197 CVE-2014-1573 70257  View
159703 30197 CVE-2014-1573 1030978  View
159704 30197 CVE-2014-1573 https://bugzilla.mozilla.org/show_bug.cgi?id=1075578  View
159705 30197 CVE-2014-1573 GLSA-201607-11  View

Related JVN

Id Name Title Summary Cveinfo Name Cveinfo Id Nvdinfo Name Nvdinfo Id Cvssv2 Cvssv3 Jvnurl Published Date Last Updated Date Actions
15951 JVNDB-2014-004826 Bugzilla におけるクロスサイトスクリプティングの脆弱性 Bugzilla には、特定の CGI パラメータに使用するスカラーコンテキストを確認しないため、クロスサイトスクリプティング攻撃を実行される脆弱性が存在します。 CVE-2014-1573 68860 CVE-2014-1573 30197 4.3 http://jvndb.jvn.jp/ja/contents/2014/JVNDB-2014-004826.html 2014-10-06 2014-11-28 View