CVE-2014-2526 Multiple cross-site scripting (XSS) vulnerabilities in BarracudaDrive before 6.7 allow remote attackers to inject arbitrary web script or HTML via the (1) sForumName or (2) sDescription parameter to F...
MediumCVSS 6.1
EPSS 1.7%
- Published
- Updated
- Exploit status
- No public exploit known
Description
Multiple cross-site scripting (XSS) vulnerabilities in BarracudaDrive before 6.7 allow remote attackers to inject arbitrary web script or HTML via the (1) sForumName or (2) sDescription parameter to Forum/manage/ForumManager.lsp; (3) sHint, (4) sWord, or (5) nId parameter to Forum/manage/hangman.lsp; (6) user parameter to rtl/protected/admin/wizard/setuser.lsp; (7) name or (8) email parameter to feedback.lsp; (9) lname or (10) url parameter to private/manage/PageManager.lsp; (11) cmd parameter to fs; (12) newname, (13) description, (14) firstname, (15) lastname, or (16) id parameter to rtl/protected/mail/manage/list.lsp; or (17) PATH_INFO to fs/.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| barracudadrive | < 6.7 | 6.7 |
References
- barracudadrive.com release-notes vendor-advisory
- packetstormsecurity.com exploit third-party-advisory vdb-entry
- secpod.org broken-link
- secpod.org broken-link
- 57451 not-applicable third-party-advisory
- 66269 third-party-advisory vdb-entry
- barracudadrive-multiple-scripts-xss(91920) vdb-entry vendor-advisory