NVD Vulnerability Detail

CVE-2014-3740

Summary	Cross-site scripting (XSS) vulnerability in SpiceWorks before 7.2.00195 allows remote authenticated users to inject arbitrary web script or HTML via the Summary field in a ticket request to the portal page.
Publication Date	Sept. 12, 2014, 3:55 a.m.
Registration Date	Jan. 26, 2021, 3:11 p.m.
Last Update	Nov. 21, 2024, 11:08 a.m.

Affected software configurations

Related information, measures and tools

No	URL	タグ
1	http://osvdb.org/show/osvdb/106916
2	http://osvdb.org/show/osvdb/106916
3	http://packetstormsecurity.com/files/126596/SpiceWorks-7.2.00174-Cross-Site-Scripting.html	Exploit
4	http://packetstormsecurity.com/files/126596/SpiceWorks-7.2.00174-Cross-Site-Scripting.html	Exploit
5	http://packetstormsecurity.com/files/126994/SpiceWorks-IT-Ticketing-System-Cross-Site-Scripting.html	Exploit
6	http://packetstormsecurity.com/files/126994/SpiceWorks-IT-Ticketing-System-Cross-Site-Scripting.html	Exploit
7	http://research.openflare.org/advisories/OF-2014-07/spiceworks_xss.txt	Exploit
8	http://research.openflare.org/advisories/OF-2014-07/spiceworks_xss.txt	Exploit
9	http://research.openflare.org/poc/OF-2014-07/spiceworks_crafted_ticket.mp4
10	http://research.openflare.org/poc/OF-2014-07/spiceworks_crafted_ticket.mp4
11	http://seclists.org/fulldisclosure/2014/Jun/42	Exploit
12	http://seclists.org/fulldisclosure/2014/Jun/42	Exploit
13	http://secunia.com/advisories/58522
14	http://secunia.com/advisories/58522
15	http://www.exploit-db.com/exploits/33330	Exploit
16	http://www.exploit-db.com/exploits/33330	Exploit
17	http://www.securityfocus.com/archive/1/532346/100/0/threaded
18	http://www.securityfocus.com/archive/1/532346/100/0/threaded

Common Vulnerabilities List

No	CWE	Name	URL
1	CWE-79	クロスサイト・スクリプティング（XSS）	https://cwe.mitre.org/data/definitions/79.html

JVN Vulnerability Information

SpiceWorks におけるクロスサイトスクリプティングの脆弱性

Title	SpiceWorks におけるクロスサイトスクリプティングの脆弱性
Summary	SpiceWorks には、クロスサイトスクリプティングの脆弱性が存在します。
Possible impacts	リモート認証されたユーザにより、ポータルページに対するチケットリクエストの Summary フィールドを介して、任意の Web スクリプトまたは HTML を挿入される可能性があります。
Solution	ベンダ情報および参考情報を参照して適切な対策を実施してください。
Publication Date	May 12, 2014, midnight
Registration Date	Sept. 16, 2014, 4:31 p.m.
Last Update	Sept. 16, 2014, 4:31 p.m.

Affected System

Spiceworks Inc.

Spiceworks 7.2.00195 未満

CVE (情報セキュリティ共通脆弱性識別子)

No	Name	URL
Common Vulnerabilities and Exposures (CVE)
1	CVE-2014-3740	http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3740
National Vulnerability Database (NVD)
2	CVE-2014-3740	http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-3740

CWE (共通脆弱性タイプ一覧)

No	Name	URL
JVNDB
1	CWE-79	https://jvndb.jvn.jp/ja/cwe/CWE-79.html

ベンダー情報

No	Name	URL
Spiceworks Inc.
1	Top Page	http://www.spiceworks.com/

その他

No	Name	URL
関連文書
1	Multiple Stored XSS vulnerabilities in SpiceWorks Ticketing system	http://research.openflare.org/advisories/OF-2014-07/spiceworks_xss.txt
2	SpiceWorks 7.2.00174 Cross Site Scripting	http://packetstormsecurity.com/files/126596/SpiceWorks-7.2.00174-Cross-Site-Scripting.html

Change Log

No	Changed Details	Date of change
0	[2014年09月16日] 掲載	Feb. 17, 2018, 10:37 a.m.