Unscored severity · published Oct 21, 2014
CVE-2014-3111
Multiple cross-site scripting (XSS) vulnerabilities in FOG 0.27 through 0.32 allow remote authenticated users to inject arbitrary web script or HTML via the (1) Printer Model…
–
CVSS
1%
EPSS
No
On KEV
Description
Multiple cross-site scripting (XSS) vulnerabilities in FOG 0.27 through 0.32 allow remote authenticated users to inject arbitrary web script or HTML via the (1) Printer Model field to the Printer Management page, (2) Image Name field to the Image Management page, (3) Storage Group Name field to the Storage Management page, (4) Username field to the User Cleanup FOG Configuration page, or (5) Directory Path field to the Directory Cleaner FOG Configuration page.
Exploitation
Is it being used?
Exploit prediction (EPSS)1.0% · higher than 62% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
FO
Fog · Fogproject
0.27; 0.28; 0.29; 0.30; 0.31; 0.32 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2014-3111
CVE.org
https://www.cve.org/CVERecord?id=CVE-2014-3111
Vendor Advisory
http://fogproject.org/forum/threads/stored-xss-vulnerability-in-fog-project-version-0-27-through-0-32.10394
Exploit
http://seclists.org/fulldisclosure/2014/May/60
www.openwall.com
http://www.openwall.com/lists/oss-security/2014/04/30/2
www.securityfocus.com
http://www.securityfocus.com/archive/1/532091/100/0/threaded
www.securityfocus.com
http://www.securityfocus.com/bid/67141