CVE-2014-2214 Multiple cross-site scripting (XSS) vulnerabilities in POSH (aka Posh portal or Portaneo) 3.0 through 3.2.1 allow remote attackers to inject arbitrary web script or HTML via the (1) error parameter to...
MediumCVSS 6.1
EPSS 0.82%
- Published
- Updated
- Exploit status
- No public exploit known
Description
Multiple cross-site scripting (XSS) vulnerabilities in POSH (aka Posh portal or Portaneo) 3.0 through 3.2.1 allow remote attackers to inject arbitrary web script or HTML via the (1) error parameter to /includes/plugins/mobile/scripts/login.php or (2) id parameter to portal/openrssarticle.php
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| posh project posh | >= 3.0, <= 3.2.1 | No fix listed |
References
- seclists.org mailing-list third-party-advisory
- sysdream.com exploit third-party-advisory