Ecosyste.ms: Advisories
An open API service providing security vulnerability metadata for many open source software ecosystems.
Security Advisories: GSA_kwCzR0hTQS1xNXYyLTJ2NjYtNmh3bc4AAd_M
Improper Neutralization of Input During Web Page Generation in Direct Web Remoting
Cross-site scripting (XSS) vulnerability in Direct Web Remoting (DWR) through 2.0.10 and 3.x through 3.0.RC2 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
Permalink: https://github.com/advisories/GHSA-q5v2-2v66-6hwmJSON: https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS1xNXYyLTJ2NjYtNmh3bc4AAd_M
Source: GitHub Advisory Database
Origin: Unspecified
Severity: Moderate
Classification: General
Published: almost 2 years ago
Updated: over 1 year ago
Identifiers: GHSA-q5v2-2v66-6hwm, CVE-2014-5326
References:
- https://nvd.nist.gov/vuln/detail/CVE-2014-5326
- http://jvn.jp/en/jp/JVN52422792/index.html
- http://jvndb.jvn.jp/jvndb/JVNDB-2014-000118
- https://github.com/advisories/GHSA-q5v2-2v66-6hwm
Affected Packages
maven:org.directwebremoting:dwr
Dependent packages: 70Dependent repositories: 1,772
Downloads:
Affected Version Ranges: >= 3.0.M1, <= 3.0.RC2, < 2.0.11
Fixed in: 3.0.RC3, 2.0.11
All affected versions: 2.0.8, 2.0.9, 2.0.10
All unaffected versions: