VulnerabilityModified
CVE-2014-0362
Cross-site scripting (XSS) vulnerability on Google Search Appliance (GSA) devices before 7.0.14.G.216 and 7.2 before 7.2.0.G.114, when dynamic navigation is configured, allows remote attackers to inject arbitrary web script or HTML via input included in…
MEDIUM 4.3EPSS 1.18%
Does this matter?
Lower severity and a low EPSS score (1.18%). Track it; it rarely justifies an emergency change on its own.
Description
Cross-site scripting (XSS) vulnerability on Google Search Appliance (GSA) devices before 7.0.14.G.216 and 7.2 before 7.2.0.G.114, when dynamic navigation is configured, allows remote attackers to inject arbitrary web script or HTML via input included in a SCRIPT element.
- CVSS 2.0
- 4.3 MEDIUMAV:N/AC:M/Au:N/C:N/I:P/A:N
- EPSS
- 1.18% probability · 66th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-79
- Affected
- google/search appliance software
- Source
- cret@cert.org
References
- http://www.kb.cert.org/vuls/id/673313Third Party Advisory, US Government Resource
- http://www.securityfocus.com/bid/67176Third Party Advisory, VDB Entry
- http://www.kb.cert.org/vuls/id/673313Third Party Advisory, US Government Resource
- http://www.securityfocus.com/bid/67176Third Party Advisory, VDB Entry
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.