CVE-2014-5464 Cross-site scripting (XSS) vulnerability in the nDPI traffic classification library in ntopng (aka ntop) before 1.2.1 allows remote attackers to inject arbitrary web script or HTML via the HTTP Host h...
MediumCVSS 4.3
EPSS 4.5%
Public exploit
- Published
- Updated
- Exploit status
- Public exploit available
Description
Cross-site scripting (XSS) vulnerability in the nDPI traffic classification library in ntopng (aka ntop) before 1.2.1 allows remote attackers to inject arbitrary web script or HTML via the HTTP Host header.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| debian/ntopng(Debian:13) | < 1.2.1+dfsg1-1 | 1.2.1+dfsg1-1 |
| debian/ntopng(Debian:13) | = 1.1+dfsg2-1 | No fix listed |
| debian/ntopng(Debian:13) | = 1.1+dfsg2-2 | No fix listed |
| debian/ntopng(Debian:13) | = 1.2.0+dfsg1-1 | No fix listed |
| ntopng | <= 1.2.0 | No fix listed |
| ntopng | = 1.1 | No fix listed |
References
- 60096 third-party-advisory vendor-advisory
- packetstormsecurity.com exploit
- 20140825 ntopng 1.2.0 XSS injection using monitored network traffic exploit mailing-list
- 20140903 Re: ntopng 1.2.0 XSS injection using monitored network traffic exploit mailing-list
- 20140909 Re: ntopng 1.2.0 XSS injection using monitored network traffic exploit mailing-list
- 34419 exploit
- 110437 vdb-entry
- www.ntop.org
- 20140825 ntopng 1.2.0 XSS injection using monitored network traffic mailing-list
- 20140903 Re: ntopng 1.2.0 XSS injection using monitored network traffic mailing-list
- 69385 vdb-entry
- ntopng-httpheader-xss(95461) vdb-entry
- security-tracker.debian.org vendor-advisory