CVEvulnerability
CVE-2014-8352
4.3 MEDIUM
Official page ↗
- Status
- Modified
- Published
- 2014-11-06
- Last modified
- 2026-06-17
- Assigner
- [email protected]
- CVSS 2.0 ([email protected])
- 4.3 MEDIUM — AV:N/AC:M/Au:N/C:N/I:P/A:N
- Weaknesses
- CWE-79
Description
Cross-site scripting (XSS) vulnerability in json.php in French National Commission on Informatics and Liberty (aka CNIL) CookieViz allows remote we servers to inject arbitrary web script or HTML via the max_date parameter.
Affected configurations
• french national commission on informatics and liberty cookieviz
Related
Weakness · CWE (1)
- CWE-79 Improper Neutralization of Input During Web Page Generation weakness
References
- http://packetstormsecurity.com/files/128960/CNIL-CookieViz-Cross-Site-Scripting-SQL-Injection.html Exploit
- http://seclists.org/fulldisclosure/2014/Nov/3 Exploit
- https://exchange.xforce.ibmcloud.com/vulnerabilities/98452 exchange.xforce.ibmcloud.com
- https://github.com/LaboCNIL/CookieViz/commit/489b6050f6c53fe7b24c4bed3eeb9c25543960e2 Patch
- http://packetstormsecurity.com/files/128960/CNIL-CookieViz-Cross-Site-Scripting-SQL-Injection.html Exploit
- http://seclists.org/fulldisclosure/2014/Nov/3 Exploit
- https://exchange.xforce.ibmcloud.com/vulnerabilities/98452 exchange.xforce.ibmcloud.com
- https://github.com/LaboCNIL/CookieViz/commit/489b6050f6c53fe7b24c4bed3eeb9c25543960e2 Patch