CVE-2014-3994
Severity Score
4.3
*CVSS v3
Exploit Likelihood
*EPSS
Affected Versions
*CPE
Public Exploits
1
*Multiple Sources
Exploited in Wild
-
*KEV
Decision
-
*SSVC
Descriptions
Cross-site scripting (XSS) vulnerability in util/templatetags/djblets_js.py in Djblets before 0.7.30 and 0.8.x before 0.8.3 for Django, as used in Review Board, allows remote attackers to inject arbitrary web script or HTML via a JSON object, as demonstrated by the name field when changing a user name.
Vulnerabilidad de XSS en util/templatetags/djblets_js.py en Djblets anterior a 0.7.30 y 0.8.x anterior a 0.8.3 para Django, utilizado en Review Board, permite a atacantes remotos inyectar secuencias de comandos web o HTML arbitrarios a través de un objeto JSON, tal y como fue demostrado por el campo de nombre cuando se cambia un nombre de usuario.
*Credits:
N/A
CVSS Scores
Attack Vector
Attack Complexity
Privileges Required
User Interaction
Scope
Confidentiality
Integrity
Availability
Attack Vector
Attack Complexity
Authentication
Confidentiality
Integrity
Availability
* Common Vulnerability Scoring System
SSVC
- Decision:-
Exploitation
Automatable
Tech. Impact
* Organization's Worst-case Scenario
Timeline
- 2014-06-06 CVE Reserved
- 2014-06-16 CVE Published
- 2024-08-06 CVE Updated
- 2024-08-06 First Exploit
- 2025-03-30 EPSS Updated
- ---------- Exploited in Wild
- ---------- KEV Due Date
CWE
- CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CAPEC
References (7)
| URL | Tag | Source |
|---|---|---|
| http://seclists.org/oss-sec/2014/q2/494 | Mailing List |
|
| http://seclists.org/oss-sec/2014/q2/498 | Mailing List |
|
| http://www.securityfocus.com/bid/67932 | Third Party Advisory | |
| https://code.google.com/p/reviewboard/issues/detail?id=3406 | Not Applicable |
| URL | Date | SRC |
|---|---|---|
| https://github.com/djblets/djblets/commit/77a68c03cd619a0996f3f37337b8c39ca6643d6e | 2024-08-06 |
| URL | Date | SRC |
|---|
Affected Vendors, Products, and Versions
| Vendor | Product | Version | Other | Status | ||||||
|---|---|---|---|---|---|---|---|---|---|---|
| Vendor | Product | Version | Other | Status | <-- --> | Vendor | Product | Version | Other | Status |
| Reviewboard Search vendor "Reviewboard" | Djblets Search vendor "Reviewboard" for product "Djblets" | <= 0.7.29 Search vendor "Reviewboard" for product "Djblets" and version " <= 0.7.29" | - |
Affected
| ||||||
| Reviewboard Search vendor "Reviewboard" | Djblets Search vendor "Reviewboard" for product "Djblets" | 0.7.27 Search vendor "Reviewboard" for product "Djblets" and version "0.7.27" | - |
Affected
| ||||||
| Reviewboard Search vendor "Reviewboard" | Djblets Search vendor "Reviewboard" for product "Djblets" | 0.7.28 Search vendor "Reviewboard" for product "Djblets" and version "0.7.28" | - |
Affected
| ||||||
| Reviewboard Search vendor "Reviewboard" | Djblets Search vendor "Reviewboard" for product "Djblets" | 0.8.1 Search vendor "Reviewboard" for product "Djblets" and version "0.8.1" | - |
Affected
| ||||||
| Reviewboard Search vendor "Reviewboard" | Djblets Search vendor "Reviewboard" for product "Djblets" | 0.8.2 Search vendor "Reviewboard" for product "Djblets" and version "0.8.2" | - |
Affected
| ||||||
| Reviewboard Search vendor "Reviewboard" | Reviewboard Search vendor "Reviewboard" for product "Reviewboard" | - | - |
Affected
| ||||||