CVE-2014-4329 Cross-site scripting (XSS) vulnerability in lua/host_details.lua in ntopng 1.1 allows remote attackers to inject arbitrary web script or HTML via the host parameter.
MediumCVSS 4.3
EPSS 1.2%
- Published
- Updated
- Exploit status
- No public exploit known
Description
Cross-site scripting (XSS) vulnerability in lua/host_details.lua in ntopng 1.1 allows remote attackers to inject arbitrary web script or HTML via the host parameter.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| debian/ntopng(Debian:13) | < 1.2.0+dfsg1-1 | 1.2.0+dfsg1-1 |
| debian/ntopng(Debian:13) | = 1.1+dfsg2-1 | No fix listed |
| debian/ntopng(Debian:13) | = 1.1+dfsg2-2 | No fix listed |
| ntopng | = 1.1 | No fix listed |
References
- www.ntop.org vendor-advisory
- packetstormsecurity.com exploit
- svn.ntop.org issue-tracking
- 66456 vdb-entry
- ntopng-host-xss(92135) vdb-entry
- security-tracker.debian.org vendor-advisory