« Volver al listado

CVE-2014-3808

Estado: ModificadaMedia (4.3)—

Multiple cross-site scripting (XSS) vulnerabilities in BarracudaDrive before 6.7.2 allow remote attackers to inject arbitrary web script or HTML via the (1) role parameter to roles.lsp, (2) name parameter to user.lsp, (3) path parameter to wizard/setuser.lsp, (4) host parameter to tunnelconstr.lsp, or (5) newpath parameter to wfsconstr.lsp in rtl/protected/admin/.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (2)

Barracudadrive — BarracudadriveRealtimelogic — Barracudadrive

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2014-3808",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 4.3,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N",
          "authentication": "NONE",
          "integrityImpact": "PARTIAL",
          "accessComplexity": "MEDIUM",
          "availabilityImpact": "NONE",
          "confidentialityImpact": "NONE"
        },
        "acInsufInfo": false,
        "impactScore": 2.9,
        "baseSeverity": "MEDIUM",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 8.6,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": true
      }
    ]
  },
  "affected": [
    {
      "source": "cve@mitre.org",
      "affectedData": [
        {
          "vendor": "n/a",
          "product": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ]
    }
  ],
  "published": "2014-05-21T14:55:06.757",
  "references": [
    {
      "url": "http://secpod.org/advisories/SecPod_Advistory_BarracudaDrive_6.7.1_Mult_XSS_Vuln.txt",
      "tags": [
        "Exploit"
      ],
      "source": "cve@mitre.org"
    },
    {
      "url": "http://secpod.org/blog/?p=2309",
      "source": "cve@mitre.org"
    },
    {
      "url": "http://secunia.com/advisories/58309",
      "source": "cve@mitre.org"
    },
    {
      "url": "http://www.securityfocus.com/bid/67138",
      "source": "cve@mitre.org"
    },
    {
      "url": "http://secpod.org/advisories/SecPod_Advistory_BarracudaDrive_6.7.1_Mult_XSS_Vuln.txt",
      "tags": [
        "Exploit"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://secpod.org/blog/?p=2309",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://secunia.com/advisories/58309",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.securityfocus.com/bid/67138",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-79"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Multiple cross-site scripting (XSS) vulnerabilities in BarracudaDrive before 6.7.2 allow remote attackers to inject arbitrary web script or HTML via the (1) role parameter to roles.lsp, (2) name parameter to user.lsp, (3) path parameter to wizard/setuser.lsp, (4) host parameter to tunnelconstr.lsp, or (5) newpath parameter to wfsconstr.lsp in rtl/protected/admin/."
    },
    {
      "lang": "es",
      "value": "Múltiples vulnerabilidades de XSS en BarracudaDrive anterior a 6.7.2 permiten a atacantes remotos inyectar secuencias de comandos web o HTML arbitrarios a través del (1) parámetro role hacia roles.lsp, (2) parámetro name hacia user.lsp, (3) parámetro path hacia wizard/setuser.lsp, (4) parámetro host hacia tunnelconstr.lsp o (5) parámetro newpath hacia wfsconstr.lsp en rtl/protected/admin/."
    }
  ],
  "lastModified": "2026-06-17T00:08:55.050",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:barracudadrive:barracudadrive:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "0FE02DBE-3102-4216-8C27-E6730C870B06",
              "versionEndIncluding": "6.7.1"
            },
            {
              "criteria": "cpe:2.3:a:barracudadrive:barracudadrive:6.0:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "919AC781-2DD8-4909-A177-609BA65A4ED5"
            },
            {
              "criteria": "cpe:2.3:a:barracudadrive:barracudadrive:6.1:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "3F5D889C-4519-4D6A-B6B7-E650CC190F34"
            },
            {
              "criteria": "cpe:2.3:a:barracudadrive:barracudadrive:6.2:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "DBCD594B-5B54-4E9C-AF33-3480DDAD4AD0"
            },
            {
              "criteria": "cpe:2.3:a:barracudadrive:barracudadrive:6.3:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "B0E480CA-694D-4590-9752-E39B7FA8E07C"
            },
            {
              "criteria": "cpe:2.3:a:barracudadrive:barracudadrive:6.4:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "3E1EA8D1-FD78-4830-8377-31C89A418E3C"
            },
            {
              "criteria": "cpe:2.3:a:barracudadrive:barracudadrive:6.6:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "793D66D8-405F-4B9F-BF5A-169BF813DAB5"
            },
            {
              "criteria": "cpe:2.3:a:barracudadrive:barracudadrive:6.7:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "F1E66E5B-C2EE-422D-A212-EF02A4FAFC91"
            },
            {
              "criteria": "cpe:2.3:a:realtimelogic:barracudadrive:6.5:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "1B62D976-878B-4D55-9739-0C95E9EF7183"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "cve@mitre.org"
}