« Volver al listado

CVE-2014-3737

Estado: ModificadaBaja (2.6)—

Vulnerabilidad de XSS en templates/defaultheader.php en Lamp Design Storesprite anterior a 7 - 19-06-14, cuando utiliza el desplegable de la selección de moneda, permite a atacantes remotos inyectar secuencias de comandos web o HTML arbitrarios a través de PATH_INFO en brand.php, relacionado con la función currencyUrl.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

Storesprite — Storesprite

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2014-3737",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 2.6,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:H/Au:N/C:N/I:P/A:N",
          "authentication": "NONE",
          "integrityImpact": "PARTIAL",
          "accessComplexity": "HIGH",
          "availabilityImpact": "NONE",
          "confidentialityImpact": "NONE"
        },
        "acInsufInfo": false,
        "impactScore": 2.9,
        "baseSeverity": "LOW",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 4.9,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": true
      }
    ]
  },
  "affected": [
    {
      "source": "cve@mitre.org",
      "affectedData": [
        {
          "vendor": "n/a",
          "product": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ]
    }
  ],
  "published": "2014-07-02T20:55:05.767",
  "references": [
    {
      "url": "http://packetstormsecurity.com/files/127221/Storesprite-7-Cross-Site-Scripting.html",
      "source": "cve@mitre.org"
    },
    {
      "url": "http://secunia.com/advisories/59524",
      "source": "cve@mitre.org"
    },
    {
      "url": "http://www.securityfocus.com/archive/1/532552/100/0/threaded",
      "source": "cve@mitre.org"
    },
    {
      "url": "http://www.securityfocus.com/bid/68197",
      "source": "cve@mitre.org"
    },
    {
      "url": "http://www.storesprite.com/docs/26/htb23215_xss_vulnerability/",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "cve@mitre.org"
    },
    {
      "url": "https://www.htbridge.com/advisory/HTB23215",
      "source": "cve@mitre.org"
    },
    {
      "url": "http://packetstormsecurity.com/files/127221/Storesprite-7-Cross-Site-Scripting.html",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://secunia.com/advisories/59524",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.securityfocus.com/archive/1/532552/100/0/threaded",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.securityfocus.com/bid/68197",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.storesprite.com/docs/26/htb23215_xss_vulnerability/",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://www.htbridge.com/advisory/HTB23215",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-79"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Cross-site scripting (XSS) vulnerability in templates/defaultheader.php in Lamp Design Storesprite before 7 - 19-06-14, when using the currency selection dropdown, allows remote attackers to inject arbitrary web script or HTML via the PATH_INFO to brand.php, related to the currencyUrl function."
    },
    {
      "lang": "es",
      "value": "Vulnerabilidad de XSS en templates/defaultheader.php en Lamp Design Storesprite anterior a 7 - 19-06-14, cuando utiliza el desplegable de la selección de moneda, permite a atacantes remotos inyectar secuencias de comandos web o HTML arbitrarios a través de PATH_INFO en brand.php, relacionado con la función currencyUrl."
    }
  ],
  "lastModified": "2026-06-17T00:08:49.167",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:storesprite:storesprite:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "FE0EE132-6826-4444-915A-AB67FBF5248F",
              "versionEndIncluding": "7_24-04-13"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "cve@mitre.org"
}