CVE-2014-3877 Incomplete blacklist vulnerability in Frams' Fast File EXchange (F*EX, aka fex) before fex-20140530 allows remote attackers to conduct cross-site scripting (XSS) attacks via the addto parameter to fup...
MediumCVSS 4.3
EPSS 1.9%
- Published
- Updated
- Exploit status
- No public exploit known
Description
Incomplete blacklist vulnerability in Frams' Fast File EXchange (F*EX, aka fex) before fex-20140530 allows remote attackers to conduct cross-site scripting (XSS) attacks via the addto parameter to fup.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| debian/fex(Debian:12) | < 20140530-1 | 20140530-1 |
| debian/fex(Debian:12) | = 20110601-1 | No fix listed |
| debian/fex(Debian:12) | = 20110608-1 | No fix listed |
| debian/fex(Debian:12) | = 20110608-2 | No fix listed |
| debian/fex(Debian:12) | = 20110610-1 | No fix listed |
| debian/fex(Debian:12) | = 20110610-2 | No fix listed |
| debian/fex(Debian:12) | = 20110620-1 | No fix listed |
| debian/fex(Debian:12) | = 20110622-1 | No fix listed |
| debian/fex(Debian:12) | = 20110726-1 | No fix listed |
| debian/fex(Debian:12) | = 20110726-1~bpo60+1 | No fix listed |
| debian/fex(Debian:12) | = 20111129-1 | No fix listed |
| debian/fex(Debian:12) | = 20111129-2 | No fix listed |
| debian/fex(Debian:12) | = 20120215-1 | No fix listed |
| debian/fex(Debian:12) | = 20120215-2 | No fix listed |
| debian/fex(Debian:12) | = 20120215-3 | No fix listed |
| debian/fex(Debian:12) | = 20120215-3~bpo60+1 | No fix listed |
| debian/fex(Debian:12) | = 20120718-1 | No fix listed |
| debian/fex(Debian:12) | = 20120718-2 | No fix listed |
| debian/fex(Debian:12) | = 20120718-3 | No fix listed |
| debian/fex(Debian:12) | = 20120718-4 | No fix listed |
| debian/fex(Debian:12) | = 20120718-5 | No fix listed |
| debian/fex(Debian:12) | = 20120930-1 | No fix listed |
| debian/fex(Debian:12) | = 20121027-1 | No fix listed |
| debian/fex(Debian:12) | = 20121107-1 | No fix listed |
| debian/fex(Debian:12) | = 20121107-1~bpo60+1 | No fix listed |
Show 36 more
| Product | Affected versions | Fixed in |
|---|---|---|
| debian/fex(Debian:12) | = 20130217-1 | No fix listed |
| debian/fex(Debian:12) | = 20130510-1 | No fix listed |
| debian/fex(Debian:12) | = 20130805-1 | No fix listed |
| debian/fex(Debian:12) | = 20140226-1 | No fix listed |
| debian/fex(Debian:12) | = 20140313-1 | No fix listed |
| debian/fex(Debian:13) | < 20140530-1 | 20140530-1 |
| debian/fex(Debian:13) | = 20110601-1 | No fix listed |
| debian/fex(Debian:13) | = 20110608-1 | No fix listed |
| debian/fex(Debian:13) | = 20110608-2 | No fix listed |
| debian/fex(Debian:13) | = 20110610-1 | No fix listed |
| debian/fex(Debian:13) | = 20110610-2 | No fix listed |
| debian/fex(Debian:13) | = 20110620-1 | No fix listed |
| debian/fex(Debian:13) | = 20110622-1 | No fix listed |
| debian/fex(Debian:13) | = 20110726-1 | No fix listed |
| debian/fex(Debian:13) | = 20110726-1~bpo60+1 | No fix listed |
| debian/fex(Debian:13) | = 20111129-1 | No fix listed |
| debian/fex(Debian:13) | = 20111129-2 | No fix listed |
| debian/fex(Debian:13) | = 20120215-1 | No fix listed |
| debian/fex(Debian:13) | = 20120215-2 | No fix listed |
| debian/fex(Debian:13) | = 20120215-3 | No fix listed |
| debian/fex(Debian:13) | = 20120215-3~bpo60+1 | No fix listed |
| debian/fex(Debian:13) | = 20120718-1 | No fix listed |
| debian/fex(Debian:13) | = 20120718-2 | No fix listed |
| debian/fex(Debian:13) | = 20120718-3 | No fix listed |
| debian/fex(Debian:13) | = 20120718-4 | No fix listed |
| debian/fex(Debian:13) | = 20120718-5 | No fix listed |
| debian/fex(Debian:13) | = 20120930-1 | No fix listed |
| debian/fex(Debian:13) | = 20121027-1 | No fix listed |
| debian/fex(Debian:13) | = 20121107-1 | No fix listed |
| debian/fex(Debian:13) | = 20121107-1~bpo60+1 | No fix listed |
| debian/fex(Debian:13) | = 20130217-1 | No fix listed |
| debian/fex(Debian:13) | = 20130510-1 | No fix listed |
| debian/fex(Debian:13) | = 20130805-1 | No fix listed |
| debian/fex(Debian:13) | = 20140226-1 | No fix listed |
| debian/fex(Debian:13) | = 20140313-1 | No fix listed |
| ulli horlacher fex | <= 20140313 | No fix listed |
References
- Debian Security Tracker CVE-2014-3877 vendor-advisory
- fex.rus.uni-stuttgart.de patch
- packetstormsecurity.com exploit
- www.lsexperts.de exploit