Vulnerability Description
Cross-site scripting (XSS) vulnerability in Login.aspx in Bizagi BPM Suite before 10.3 allows remote attackers to inject arbitrary web script or HTML via the txtUsername parameter.
CVSS Score
4.3
MEDIUM
AV:N/AC:M/Au:N/C:N/I:P/A:N
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Bizagi | Business Process Management Suite | <= 10.2 |
Related Weaknesses (CWE)
References
- http://www.kb.cert.org/vuls/id/112412Third Party AdvisoryUS Government Resource
- http://www.securityfocus.com/bid/67591
- http://www.kb.cert.org/vuls/id/112412Third Party AdvisoryUS Government Resource
- http://www.securityfocus.com/bid/67591
FAQ
What is CVE-2014-2947?
CVE-2014-2947 is a vulnerability with a CVSS score of 4.3 (MEDIUM). Cross-site scripting (XSS) vulnerability in Login.aspx in Bizagi BPM Suite before 10.3 allows remote attackers to inject arbitrary web script or HTML via the txtUsername parameter.
How severe is CVE-2014-2947?
CVE-2014-2947 has been rated MEDIUM with a CVSS base score of 4.3/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2014-2947?
Check the references section above for vendor advisories and patch information. Affected products include: Bizagi Business Process Management Suite.