« Volver al listado

CVE-2014-5360

Estado: ModificadaMedia (4.3)—

Cross-site scripting (XSS) vulnerability in the admin interface in LANDESK Management Suite before 9.6 SP1 allows remote attackers to inject arbitrary web script or HTML via the AMTVersion parameter to remote/serverlist_grouptree.aspx.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

Landesk — Landesk Management Suite

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2014-5360",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 4.3,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N",
          "authentication": "NONE",
          "integrityImpact": "PARTIAL",
          "accessComplexity": "MEDIUM",
          "availabilityImpact": "NONE",
          "confidentialityImpact": "NONE"
        },
        "acInsufInfo": false,
        "impactScore": 2.9,
        "baseSeverity": "MEDIUM",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 8.6,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": true
      }
    ]
  },
  "affected": [
    {
      "source": "cve@mitre.org",
      "affectedData": [
        {
          "vendor": "n/a",
          "product": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ]
    }
  ],
  "published": "2015-02-03T16:59:00.047",
  "references": [
    {
      "url": "http://seclists.org/fulldisclosure/2015/Feb/6",
      "tags": [
        "Exploit"
      ],
      "source": "cve@mitre.org"
    },
    {
      "url": "http://seclists.org/fulldisclosure/2015/Feb/6",
      "tags": [
        "Exploit"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-79"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Cross-site scripting (XSS) vulnerability in the admin interface in LANDESK Management Suite before 9.6 SP1 allows remote attackers to inject arbitrary web script or HTML via the AMTVersion parameter to remote/serverlist_grouptree.aspx."
    },
    {
      "lang": "es",
      "value": "Vulnerabilidad de XSS en la interfaz de administración en LANDESK Management Suite anterior a 9.6 SP1 permite a atacantes remotos inyectar secuencias de comandos web o HTML arbitrarios a través del parámetro AMTVersion en remote/serverlist_grouptree.aspx."
    }
  ],
  "lastModified": "2026-06-17T00:11:26.453",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:landesk:landesk_management_suite:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "974DF68F-3957-421C-A82B-557A47A03B60",
              "versionEndIncluding": "9.6"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "vendorComments": [
    {
      "comment": "The vulnerability described in CVE-2014-5360 was fixed in Landesk Management Suit (LDMS) version: 9.5 SP3, 9.6 SP1, 10.0. LDMS Customers are encouraged to upgrade to the listed versions or newer",
      "lastModified": "2016-04-07T09:40:37.930",
      "organization": "LANDESK"
    }
  ],
  "sourceIdentifier": "cve@mitre.org"
}