CVE-2014-5326 Improper Neutralization of Input During Web Page Generation in Direct Web Remoting
MediumCVSS 4.3
EPSS 1.1%
- Published
- Updated
- Exploit status
- No public exploit known
Description
Cross-site scripting (XSS) vulnerability in Direct Web Remoting (DWR) through 2.0.10 and 3.x through 3.0.RC2 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| org.directwebremoting/dwr(Maven) | < 2.0.11 | 2.0.11 |
| org.directwebremoting/dwr(Maven) | >= 3.0.M1, <= 3.0.RC2 | No fix listed |
| org.directwebremoting/dwr(Maven) | = 2.0.1 | No fix listed |
| org.directwebremoting/dwr(Maven) | = 2.0.10 | No fix listed |
| org.directwebremoting/dwr(Maven) | = 2.0.2 | No fix listed |
| org.directwebremoting/dwr(Maven) | = 2.0.3 | No fix listed |
| org.directwebremoting/dwr(Maven) | = 2.0.8 | No fix listed |
| org.directwebremoting/dwr(Maven) | = 2.0.9 | No fix listed |
| org.directwebremoting/dwr(Maven) | = 2.0.rc1 | No fix listed |
| org.directwebremoting/dwr(Maven) | = 2.0.rc2 | No fix listed |
| org.directwebremoting/dwr(Maven) | >= 3.0.M1, < 3.0.RC3 | 3.0.RC3 |
| org.directwebremoting/dwr(Maven) | = 3.0.M1 | No fix listed |
| directwebremoting direct web remoting | <= 2.0.10 | No fix listed |
| directwebremoting direct web remoting | = 3.0-rc1 | No fix listed |
| directwebremoting direct web remoting | = 3.0-rc2 | No fix listed |
References
- nvd.nist.gov third-party-advisory vendor-advisory
- JVN#52422792 third-party-advisory
- JVNDB-2014-000118 third-party-advisory
- github.com