CVE-2014-0335 in Dimensions CM
Summary
by MITRE
Multiple cross-site scripting (XSS) vulnerabilities in the web client in Serena Dimensions CM 12.2 build 7.199.0 allow remote attackers to inject arbitrary web script or HTML via the (1) DB_CONN, (2) DB_NAME, (3) DM_HOST, (4) MAN_DB_NAME, (5) framecmd, (6) identifier, (7) merant.adm.adapters.AdmDialogPropertyMgr, (8) nav_frame, (9) nav_jsp, (10) target_frame, (11) id, or (12) type parameter to the dimensions/ URI.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 05/07/2026
The vulnerability identified as CVE-2014-0335 represents a critical cross-site scripting flaw within the web client interface of Serena Dimensions CM version 12.2 build 7.199.0. This security weakness stems from inadequate input validation and sanitization mechanisms that fail to properly process user-supplied data before rendering it within web pages. The vulnerability affects multiple parameters within the dimensions/ URI endpoint, creating numerous attack vectors that adversaries can exploit to execute malicious code within the context of authenticated users' browsers. The affected parameters include database connection strings, hostnames, navigation frames, and various identifier fields that are commonly used in the application's web interface.
The technical exploitation of this vulnerability occurs when remote attackers submit malicious payloads through the identified parameter names, which are then reflected back to users without proper sanitization. The flaw allows attackers to inject arbitrary HTML and JavaScript code that executes in the victim's browser context, potentially leading to session hijacking, credential theft, or redirection to malicious sites. This type of vulnerability falls under CWE-79, which specifically addresses Cross-Site Scripting flaws in software applications. The vulnerability's classification as a remote attack vector means that no local access or authentication is required for exploitation, making it particularly dangerous in environments where the application is accessible over the network.
The operational impact of CVE-2014-0335 extends beyond simple code execution, as it can enable attackers to manipulate the application's functionality and compromise the integrity of the configuration management system. When an attacker successfully exploits this vulnerability, they can potentially access sensitive configuration data, modify database connection parameters, or redirect users to phishing sites that appear legitimate within the application context. The vulnerability affects the core web client functionality, which means that any user interacting with the dimensions/ URI endpoint could become compromised. This creates a significant risk for organizations relying on Serena Dimensions CM for software configuration management, as the attack surface includes all users who have access to the web interface.
Mitigation strategies for this vulnerability should focus on implementing comprehensive input validation and output encoding mechanisms throughout the application's web client components. Organizations should immediately apply the vendor-provided security patches or updates that address the identified XSS vulnerabilities. Additionally, implementing proper parameter sanitization techniques, including the use of secure coding practices that escape or encode user-supplied input before rendering it in web pages, can prevent exploitation of similar vulnerabilities. The implementation of Content Security Policy headers and regular security assessments can further reduce the risk of successful exploitation. From an ATT&CK framework perspective, this vulnerability maps to techniques involving command and control communication and credential access, as attackers can leverage the XSS flaw to establish persistent access to the application and potentially escalate privileges within the configuration management environment.