CVE-2014-100004

EPSS 2.0%

Vexday Risk Score

18Low

SSVC decision (CISA)

Attend

PoC available → attend closely

Exploit maturity

Functional exploit

Automatable exploit available (Nuclei/Metasploit).

CVSS —EPSS 2.0%KEV nãoPoC —Nuclei simMetasploit —Patch —

Lifecycle

13 Jan 2015Published on NVD

Recommendation: Plan a near-term fix — a public PoC already exists.

Cross-site scripting (XSS) vulnerability in Sitecore CMS before 7.0 Update-4 (rev. 140120) allows remote attackers to inject arbitrary web script or HTML via the xmlcontrol parameter to the default URI. NOTE: some of these details are obtained from third party information.

Affected products

n/a · n/a

References

http://osvdb.org/102660 http://secunia.com/advisories/56705 https://exchange.xforce.ibmcloud.com/vulnerabilities/90833 http://sitecorekh.blogspot.dk/2014/01/sitecore-releases-70-update-4-rev-140120.html http://www.securityfocus.com/archive/1/530901/100/0/threaded http://www.securityfocus.com/bid/65254