Vulnerability Description
Multiple cross-site scripting (XSS) vulnerabilities in Dell SonicWALL Email Security 7.4.5 and earlier allow remote authenticated administrators to inject arbitrary web script or HTML via (1) the uploadPatch parameter to the System/Advanced page (settings_advanced.html) or (2) the uploadLicenses parameter in the License management (settings_upload_dlicense.html) page.
CVSS Score
MEDIUM
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Sonicwall | Email Security Appliance | <= 7.4.5 |
Related Weaknesses (CWE)
References
- http://seclists.org/fulldisclosure/2014/Mar/409ExploitMailing ListThird Party Advisory
- http://www.securityfocus.com/archive/1/531642/100/0/threaded
- http://www.securityfocus.com/bid/66501Third Party AdvisoryVDB Entry
- http://www.securitytracker.com/id/1029965Third Party AdvisoryVDB Entry
- http://www.sonicwall.com/us/shared/download/Support-Bulletin_Email-Security_ScriBroken Link
- http://www.vulnerability-lab.com/get_content.php?id=1191Exploit
- http://seclists.org/fulldisclosure/2014/Mar/409ExploitMailing ListThird Party Advisory
- http://www.securityfocus.com/archive/1/531642/100/0/threaded
- http://www.securityfocus.com/bid/66501Third Party AdvisoryVDB Entry
- http://www.securitytracker.com/id/1029965Third Party AdvisoryVDB Entry
- http://www.sonicwall.com/us/shared/download/Support-Bulletin_Email-Security_ScriBroken Link
- http://www.vulnerability-lab.com/get_content.php?id=1191Exploit
FAQ
What is CVE-2014-2879?
CVE-2014-2879 is a vulnerability with a CVSS score of 4.3 (MEDIUM). Multiple cross-site scripting (XSS) vulnerabilities in Dell SonicWALL Email Security 7.4.5 and earlier allow remote authenticated administrators to inject arbitrary web script or HTML via (1) the uplo...
How severe is CVE-2014-2879?
CVE-2014-2879 has been rated MEDIUM with a CVSS base score of 4.3/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2014-2879?
Check the references section above for vendor advisories and patch information. Affected products include: Sonicwall Email Security Appliance.