VulnerabilityModified

CVE-2014-9405

A Cross-Site Scripting (XSS) vulnerability exists in the description field of an Download RSS item or Contacts in Freebox OS Web interface 3.0.2, which allows malicious users to execute arbitrary code.

MEDIUM 5.4EPSS 1.50%

Does this matter?

Lower severity and a low EPSS score (1.50%). Track it; it rarely justifies an emergency change on its own.

Description

CVSS 3.1: 5.4 MEDIUMCVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
EPSS: 1.50% probability · 73th percentile
CISA KEV: Not listed
Weakness: CWE-79
Affected: free/freebox os
Source: cve@mitre.org

References

http://packetstormsecurity.com/files/132121/FreeBox-3.0.2-Cross-Site-Request-Forgery-Cross-Site-Scripting.htmlExploit, Third Party Advisory, VDB Entry
http://seclists.org/fulldisclosure/2015/Jun/1Exploit, Mailing List, Third Party Advisory
http://www.securityfocus.com/archive/1/535660/100/0/threadedExploit, Third Party Advisory, VDB Entry
http://www.securityfocus.com/bid/74936Third Party Advisory, VDB Entry
http://packetstormsecurity.com/files/132121/FreeBox-3.0.2-Cross-Site-Request-Forgery-Cross-Site-Scripting.htmlExploit, Third Party Advisory, VDB Entry
http://seclists.org/fulldisclosure/2015/Jun/1Exploit, Mailing List, Third Party Advisory
http://www.securityfocus.com/archive/1/535660/100/0/threadedExploit, Third Party Advisory, VDB Entry
http://www.securityfocus.com/bid/74936Third Party Advisory, VDB Entry

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.