NVD Vulnerability Detail

CVE-2014-4312

Summary	Multiple cross-site scripting (XSS) vulnerabilities in Epicor Enterprise 7.4 before FS74SP6_HotfixTL054181 allow remote attackers to inject arbitrary web script or HTML via the (1) Notes section to Order details; (2) Description section to "Order to consume"; (3) Favorites name section to Favorites; (4) FiltKeyword parameter to Procurement/EKPHTML/search_item_bt.asp; (5) Act parameter to Procurement/EKPHTML/EnterpriseManager/Budget/ImportBudget_fr.asp; (6) hdnOpener or (7) hdnApproverFieldName parameter to Procurement/EKPHTML/EnterpriseManager/UserSearchDlg.asp; or (8) INTEGRATED parameter to Procurement/EKPHTML/EnterpriseManager/Codes.asp.
Publication Date	Oct. 10, 2014, 11:55 p.m.
Registration Date	Jan. 26, 2021, 3:12 p.m.
Last Update	Nov. 21, 2024, 11:09 a.m.

Affected software configurations

Configuration1		or higher	or less	more than	less than
cpe:2.3:a:epicor:epicor_enterprise::::::::			7.4

Related information, measures and tools

No	URL	タグ
1	http://osvdb.org/show/osvdb/112464
2	http://osvdb.org/show/osvdb/112464
3	http://osvdb.org/show/osvdb/112465
4	http://osvdb.org/show/osvdb/112465
5	http://osvdb.org/show/osvdb/112466
6	http://osvdb.org/show/osvdb/112466
7	http://osvdb.org/show/osvdb/112467
8	http://osvdb.org/show/osvdb/112467
9	http://osvdb.org/show/osvdb/112469
10	http://osvdb.org/show/osvdb/112469
11	http://osvdb.org/show/osvdb/112470
12	http://osvdb.org/show/osvdb/112470
13	http://osvdb.org/show/osvdb/112471
14	http://osvdb.org/show/osvdb/112471
15	http://packetstormsecurity.com/files/128511/Epicor-Password-Disclosure-Cross-Site-Scripting.html	Exploit
16	http://packetstormsecurity.com/files/128511/Epicor-Password-Disclosure-Cross-Site-Scripting.html	Exploit
17	http://seclists.org/fulldisclosure/2014/Oct/2	Exploit
18	http://seclists.org/fulldisclosure/2014/Oct/2	Exploit
19	http://www.exploit-db.com/exploits/34864	Exploit
20	http://www.exploit-db.com/exploits/34864	Exploit
21	http://www.securityfocus.com/bid/70192	Exploit
22	http://www.securityfocus.com/bid/70192	Exploit
23	https://exchange.xforce.ibmcloud.com/vulnerabilities/96793
24	https://exchange.xforce.ibmcloud.com/vulnerabilities/96793

Common Vulnerabilities List

No	CWE	Name	URL
1	CWE-79	クロスサイト・スクリプティング（XSS）	https://cwe.mitre.org/data/definitions/79.html

JVN Vulnerability Information

Epicor Enterprise におけるクロスサイトスクリプティングの脆弱性

Title	Epicor Enterprise におけるクロスサイトスクリプティングの脆弱性
Summary	Epicor Enterprise には、クロスサイトスクリプティングの脆弱性が存在します。
Possible impacts	第三者により、以下の要素を介して、任意の Web スクリプトまたは HTML を挿入される可能性があります。 (1) Order 詳細の Notes セクション (2) "Order to consume" の Description セクション (3) Favorites の Favorites name セクション (4) Procurement/EKPHTML/search_item_bt.asp の FiltKeyword パラメータ (5) Procurement/EKPHTML/EnterpriseManager/Budget/ImportBudget_fr.asp の Act パラメータ (6) Procurement/EKPHTML/EnterpriseManager/UserSearchDlg.asp の hdnOpener パラメータ (7) Procurement/EKPHTML/EnterpriseManager/UserSearchDlg.asp の hdnApproverFieldName パラメータ (8) Procurement/EKPHTML/EnterpriseManager/Codes.asp の INTEGRATED パラメータ
Solution	ベンダ情報および参考情報を参照して適切な対策を実施してください。
Publication Date	Sept. 30, 2014, midnight
Registration Date	Oct. 20, 2014, 6:33 p.m.
Last Update	Oct. 20, 2014, 6:33 p.m.

Affected System

Epicor Software

Epicor Enterprise 7.4 以上 7.4 FS74SP6_HotfixTL054181 未満

CVE (情報セキュリティ共通脆弱性識別子)

No	Name	URL
Common Vulnerabilities and Exposures (CVE)
1	CVE-2014-4312	http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-4312
National Vulnerability Database (NVD)
2	CVE-2014-4312	http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-4312

CWE (共通脆弱性タイプ一覧)

No	Name	URL
JVNDB
1	CWE-79	https://jvndb.jvn.jp/ja/cwe/CWE-79.html

ベンダー情報

No	Name	URL
Epicor
1	トップページ	http://www.epicor.com/japan/Pages/default.aspx

その他

No	Name	URL
関連文書
1	Epicor Password Disclosure / Cross Site Scripting	http://packetstormsecurity.com/files/128511/Epicor-Password-Disclosure-Cross-Site-Scripting.html

Change Log

No	Changed Details	Date of change
0	[2014年10月20日] 掲載	Feb. 17, 2018, 10:37 a.m.