CVEvulnerability
CVE-2014-2879
4.3 MEDIUM
Official page ↗
- Status
- Modified
- Published
- 2014-04-17
- Last modified
- 2026-06-17
- Assigner
- [email protected]
- CVSS 2.0 ([email protected])
- 4.3 MEDIUM — AV:N/AC:M/Au:N/C:N/I:P/A:N
- Weaknesses
- CWE-79
Description
Multiple cross-site scripting (XSS) vulnerabilities in Dell SonicWALL Email Security 7.4.5 and earlier allow remote authenticated administrators to inject arbitrary web script or HTML via (1) the uploadPatch parameter to the System/Advanced page (settings_advanced.html) or (2) the uploadLicenses parameter in the License management (settings_upload_dlicense.html) page.
Affected configurations
• sonicwall email security appliance (<= 7.4.5)
Related
Weakness · CWE (1)
- CWE-79 Improper Neutralization of Input During Web Page Generation weakness
References
- http://seclists.org/fulldisclosure/2014/Mar/409 Exploit, Mailing List, Third Party Advisory
- http://www.securityfocus.com/archive/1/531642/100/0/threaded www.securityfocus.com
- http://www.securityfocus.com/bid/66501 Third Party Advisory, VDB Entry
- http://www.securitytracker.com/id/1029965 Third Party Advisory, VDB Entry
- http://www.sonicwall.com/us/shared/download/Support-Bulletin_Email-Security_Scripting_Vulnerability__Resolved_in__ES746.pdf Broken Link
- http://www.vulnerability-lab.com/get_content.php?id=1191 Exploit
- http://seclists.org/fulldisclosure/2014/Mar/409 Exploit, Mailing List, Third Party Advisory
- http://www.securityfocus.com/archive/1/531642/100/0/threaded www.securityfocus.com
- http://www.securityfocus.com/bid/66501 Third Party Advisory, VDB Entry
- http://www.securitytracker.com/id/1029965 Third Party Advisory, VDB Entry
- http://www.sonicwall.com/us/shared/download/Support-Bulletin_Email-Security_Scripting_Vulnerability__Resolved_in__ES746.pdf Broken Link
- http://www.vulnerability-lab.com/get_content.php?id=1191 Exploit