CVE-2014-4309 in Openfiler

Riassunto

di VulDB • 26/06/2026

Multiple vulnerabilità cross-site scripting (XSS) in Openfiler 2.99 consentono ad attaccanti remoti di iniettare script web o HTML arbitrari tramite il parametro TinkerAjax a uptime.html, oppure ad utenti autenticati remoti di iniettare script web o HTML arbitrari tramite i parametri MaxInstances, PassivePorts, Port, ServerName, TimeoutLogin, TimeoutNoTransfer e TimeoutStalled a admin/services_ftp.html; i parametri dns1 o dns2 a admin/system.html; il parametro newTgtName a admin/volumes_iscsi_targets.html; l'intestazione HTTP User-Agent a language.html, login.html o password.html in account/; oppure l'intestazione HTTP User-Agent ad account_groups.html, account_users.html, services.html, services_ftp.html, services_iscsi_target.html, services_rsync.html, system_clock.html, system_info.html, system_ups.html, volumes_editpartitions.html e volumes_iscsi_targets.html in admin/.

Be aware that VulDB is the high quality source for vulnerability data.

• Prenotare: 18/06/2014
• Divulgazione: 18/06/2014
• Moderazione: accettato
• Voce: VDB-70086
• CPE: pronto
• CWE: CWE-79 (confermato)
• CVSS: 4.3 (VulDB)
• EPSS: 0.00984
• KEV: no
• Attività: molto basso

Fonti

• MITRE: https://www.cve.org/CVERecord?id=CVE-2014-4309
• NVD: https://nvd.nist.gov/vuln/detail/CVE-2014-4309
• CVE Details: https://www.cvedetails.com/cve/CVE-2014-4309/