Unscored severity · published Nov 28, 2014
CVE-2014-7850
Cross-site scripting (XSS) vulnerability in the Web UI in FreeIPA 4.x before 4.1.2 allows remote attackers to inject arbitrary web script or HTML via vectors related to breadcrumb…
–
CVSS
1.9%
EPSS
No
On KEV
Description
Cross-site scripting (XSS) vulnerability in the Web UI in FreeIPA 4.x before 4.1.2 allows remote attackers to inject arbitrary web script or HTML via vectors related to breadcrumb navigation.
Exploitation
Is it being used?
Exploit prediction (EPSS)1.9% · higher than 79% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
FR
Freeipa · Freeipa
4.0.0; 4.0.1; 4.0.2; 4.0.3; 4.0.4; 4.0.5; +2 more · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2014-7850
CVE.org
https://www.cve.org/CVERecord?id=CVE-2014-7850
Vendor Advisory
http://lists.fedoraproject.org/pipermail/package-announce/2014-November/144848.html
Vendor Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=1165280
Vendor Advisory
https://fedorahosted.org/freeipa/ticket/4742
More from Freeipa
9.8
CVE-2015-5284
ipa-kra-install in FreeIPA before 4.2.2 puts the CA agent certificate and private key in /etc/httpd/alias/kra-agent.pem, which is world readable
8.8
CVE-2024-2698
Freeipa: delegation rules allow a proxy service to impersonate any user to access another target service
8.8
CVE-2019-14867
A flaw was found in IPA, all 4.6.x versions before 4.6.7, all 4.7.x versions before 4.7.4 and all 4.8.x versions before 4.8.3, in the way the internal function ber_scanf() was…
8.8
CVE-2012-5631
ipa 3.0 does not properly check server identity before sending credential containing cookies
8.8
CVE-2017-11191
FreeIPA 4.x with API version 2.213 allows a remote authenticated users to bypass intended account-locking restrictions via an unlock action with an old session ID (for the same…