CVE-2014-9325
TWiki 6.0.1 QUERYSTRING / QUERYPARAMSTRING XSS
Severity Score
Exploit Likelihood
Affected Versions
Public Exploits
4Exploited in Wild
-Decision
Descriptions
Multiple cross-site scripting (XSS) vulnerabilities in TWiki 6.0.1 allow remote attackers to inject arbitrary web script or HTML via the (1) QUERYSTRING variable in lib/TWiki.pm or (2) QUERYPARAMSTRING variable in lib/TWiki/UI/View.pm, as demonstrated by the QUERY_STRING to do/view/Main/TWikiPreferences.
Múltiples vulnerabilidades de XSS en TWiki 6.0.1 permiten a atacantes remotos inyectar secuencias de comandos web o HTML arbitrarios a través de (1) la variable QUERYSTRING en lib/TWiki.pm o (2) la variable QUERYPARAMSTRING en lib/TWiki/UI/View.pm, tal y como fue demostrado por QUERY_STRING en do/view/Main/TWikiPreferences.
TWiki version 6.0.1 suffers from a cross site scripting vulnerability in the QUERYSTRING and QUERYPARAMSTRING variables.
CVSS Scores
SSVC
- Decision:-
Timeline
- 2014-12-07 CVE Reserved
- 2014-12-19 CVE Published
- 2014-12-19 First Exploit
- 2024-08-06 CVE Updated
- 2025-03-30 EPSS Updated
- ---------- Exploited in Wild
- ---------- KEV Due Date
CWE
- CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CAPEC
References (5)
| URL | Tag | Source |
|---|
| URL | Date | SRC |
|---|---|---|
| https://packetstorm.news/files/id/129654 | 2014-12-19 | |
| http://packetstormsecurity.com/files/129654/TWiki-6.0.1-QUERYSTRING-QUERYPARAMSTRING-XSS.html | 2024-08-06 | |
| http://seclists.org/fulldisclosure/2014/Dec/81 | 2024-08-06 | |
| http://www.securitytracker.com/id/1031399 | 2024-08-06 |
| URL | Date | SRC |
|---|
| URL | Date | SRC |
|---|---|---|
| http://twiki.org/cgi-bin/view/Codev/SecurityAlert-CVE-2014-9325 | 2015-01-03 |