| Vulnerability Name: | CVE-2014-4075 (CCN-96763) | ||||||||
| Assigned: | 2014-10-14 | ||||||||
| Published: | 2014-10-14 | ||||||||
| Updated: | 2018-10-12 | ||||||||
| Summary: | Cross-site scripting (XSS) vulnerability in System.Web.Mvc.dll in Microsoft ASP.NET Model View Controller (MVC) 2.0 through 5.1 allows remote attackers to inject arbitrary web script or HTML via a crafted web page, aka "MVC XSS Vulnerability." | ||||||||
| CVSS v3 Severity: | 7.3 High (CCN CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L)
| ||||||||
| CVSS v2 Severity: | 4.3 Medium (CVSS v2 Vector: AV:N/AC:M/Au:N/C:N/I:P/A:N) 3.2 Low (Temporal CVSS v2 Vector: AV:N/AC:M/Au:N/C:N/I:P/A:N/E:U/RL:OF/RC:C)
5.0 Medium (CCN Temporal CVSS v2 Vector: AV:N/AC:M/Au:N/C:P/I:P/A:P/E:U/RL:OF/RC:C)
| ||||||||
| Vulnerability Type: | CWE-79 | ||||||||
| Vulnerability Consequences: | Bypass Security | ||||||||
| References: | Source: CONFIRM Type: Vendor Advisory http://blogs.technet.com/b/srd/archive/2014/10/14/accessing-risk-for-the-october-2014-security-updates.aspx Source: MITRE Type: CNA CVE-2014-4075 Source: SECUNIA Type: UNKNOWN 60971 Source: CCN Type: Microsoft Security Bulletin MS14-059 Vulnerability in ASP.NET MVC Could Allow Security Feature Bypass (2990942) Source: BID Type: UNKNOWN 70352 Source: CCN Type: BID-70352 Microsoft ASP.NET MVC CVE-2014-4075 Cross Site Scripting Vulnerability Source: SECTRACK Type: UNKNOWN 1031023 Source: MS Type: UNKNOWN MS14-059 Source: XF Type: UNKNOWN ms-asp-cve20144075-security-bypass(96763) Source: CCN Type: WhiteSource Vulnerability Database CVE-2014-4075 | ||||||||
| Vulnerable Configuration: | Configuration 1: Denotes that component is vulnerable | ||||||||
| Oval Definitions | |||||||||
| |||||||||
| BACK | |||||||||