CVEvulnerability
CVE-2014-3808
4.3 MEDIUM
Official page ↗
- Status
- Modified
- Published
- 2014-05-21
- Last modified
- 2026-06-17
- Assigner
- [email protected]
- CVSS 2.0 ([email protected])
- 4.3 MEDIUM — AV:N/AC:M/Au:N/C:N/I:P/A:N
- Weaknesses
- CWE-79
Description
Multiple cross-site scripting (XSS) vulnerabilities in BarracudaDrive before 6.7.2 allow remote attackers to inject arbitrary web script or HTML via the (1) role parameter to roles.lsp, (2) name parameter to user.lsp, (3) path parameter to wizard/setuser.lsp, (4) host parameter to tunnelconstr.lsp, or (5) newpath parameter to wfsconstr.lsp in rtl/protected/admin/.
Affected configurations
• barracudadrive barracudadrive (<= 6.7.1)
• barracudadrive barracudadrive 6.0
• barracudadrive barracudadrive 6.1
• barracudadrive barracudadrive 6.2
• barracudadrive barracudadrive 6.3
• barracudadrive barracudadrive 6.4
• barracudadrive barracudadrive 6.6
• barracudadrive barracudadrive 6.7
• realtimelogic barracudadrive 6.5
Related
Weakness · CWE (1)
- CWE-79 Improper Neutralization of Input During Web Page Generation weakness
References
- http://secpod.org/advisories/SecPod_Advistory_BarracudaDrive_6.7.1_Mult_XSS_Vuln.txt Exploit
- http://secpod.org/blog/?p=2309 secpod.org
- http://secunia.com/advisories/58309 secunia.com
- http://www.securityfocus.com/bid/67138 www.securityfocus.com
- http://secpod.org/advisories/SecPod_Advistory_BarracudaDrive_6.7.1_Mult_XSS_Vuln.txt Exploit
- http://secpod.org/blog/?p=2309 secpod.org
- http://secunia.com/advisories/58309 secunia.com
- http://www.securityfocus.com/bid/67138 www.securityfocus.com