Unscored severity · published Jul 3, 2014
CVE-2014-3149
Cross-site scripting (XSS) vulnerability in Invision Power IP.Board (aka IPB or Power Board) 3.3.x and 3.4.x through 3.4.6, as downloaded before 20140424, or IP.Nexus 1.5.x…
–
CVSS
1.9%
EPSS
No
On KEV
Description
Cross-site scripting (XSS) vulnerability in Invision Power IP.Board (aka IPB or Power Board) 3.3.x and 3.4.x through 3.4.6, as downloaded before 20140424, or IP.Nexus 1.5.x through 1.5.9, as downloaded before 20140424, allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
Exploitation
Is it being used?
Exploit prediction (EPSS)1.9% · higher than 80% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
IP
Invision Power Board · Invisioncommunity
3.3.0; 3.3.0; 3.3.0; 3.3.0; 3.3.0; 3.3.0; +18 more · source: NVD
IP
Ip.nexus · Invisionpower
1.5.0; 1.5.1; 1.5.2; 1.5.3; 1.5.4; 1.5.5; +4 more · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2014-3149
CVE.org
https://www.cve.org/CVERecord?id=CVE-2014-3149
Patch
http://community.invisionpower.com/topic/399747-ipboard-33x-34x-security-update
packetstormsecurity.com
http://packetstormsecurity.com/files/127328/IP.Board-3.4.x-3.3.x-Cross-Site-Scripting.html
www.christian-schneider.net
http://www.christian-schneider.net/advisories/CVE-2014-3149.txt
www.securityfocus.com
http://www.securityfocus.com/archive/1/532618/100/0/threaded
www.securityfocus.com
http://www.securityfocus.com/bid/67164
More from Invision Power Board
9.8
CVE-2013-3725
Invision Power Board (IPB) through 3.x allows admin account takeover leading to code execution
9.8
CVE-2012-2226
Invision Power Board before 3.3.1 fails to sanitize user-supplied input which could allow remote attackers to obtain sensitive information or execute arbitrary code by uploading a…
9.8
CVE-2017-8898
Invision Power Services (IPS) Community Suite 4.1.19.2 and earlier has stored XSS in the Announcements, allowing privilege escalation from an Invision Power Board moderator to an…
8.8
CVE-2014-4928
SQL injection vulnerability in Invision Power Board (aka IPB or IP.Board) before 3.4.6 allows remote attackers to execute arbitrary SQL commands via the cId parameter
8.1
CVE-2017-8899
Invision Power Services (IPS) Community Suite 4.1.19.2 and earlier has a composite of Stored XSS and Information Disclosure issues in the attachments feature found in User CP