CVE-2014-7850 Cross-site scripting (XSS) vulnerability in the Web UI in FreeIPA 4.x before 4.1.2 allows remote attackers to inject arbitrary web script or HTML via vectors related to breadcrumb navigation.
MediumCVSS 4.3
EPSS 1.9%
- Published
- Updated
- Exploit status
- No public exploit known
Description
Cross-site scripting (XSS) vulnerability in the Web UI in FreeIPA 4.x before 4.1.2 allows remote attackers to inject arbitrary web script or HTML via vectors related to breadcrumb navigation.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| debian/freeipa(Debian:12) | < 4.3.1-1 | 4.3.1-1 |
| debian/freeipa(Debian:13) | < 4.3.1-1 | 4.3.1-1 |
| debian/freeipa(Debian:14) | < 4.3.1-1 | 4.3.1-1 |
| freeipa | = 4.0.0 | No fix listed |
| freeipa | = 4.0.1 | No fix listed |
| freeipa | = 4.0.2 | No fix listed |
| freeipa | = 4.0.3 | No fix listed |
| freeipa | = 4.0.4 | No fix listed |
| freeipa | = 4.0.5 | No fix listed |
| freeipa | = 4.1.0 | No fix listed |
| freeipa | = 4.1.1 | No fix listed |
References
- Debian Security Tracker CVE-2014-7850 vendor-advisory
- FEDORA-2014-15601 vendor-advisory
- bugzilla.redhat.com vendor-advisory
- fedorahosted.org vendor-advisory