Unscored severity · published Dec 16, 2014
CVE-2014-8247
Cross-site scripting (XSS) vulnerability in CA Release Automation (formerly iTKO LISA Release Automation) before 4.7.1 b448 allows remote attackers to inject arbitrary web script…
–
CVSS
1.8%
EPSS
No
On KEV
Description
Cross-site scripting (XSS) vulnerability in CA Release Automation (formerly iTKO LISA Release Automation) before 4.7.1 b448 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
Exploitation
Is it being used?
Exploit prediction (EPSS)1.8% · higher than 78% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
RA
Release Automation · Broadcom
through 4.7.1 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2014-8247
CVE.org
https://www.cve.org/CVERecord?id=CVE-2014-8247
seclists.org
http://seclists.org/fulldisclosure/2014/Dec/55
securitytracker.com
http://securitytracker.com/id?1031375
Vendor Advisory
http://www.ca.com/us/support/ca-support-online/product-content/recommended-reading/security-notices/ca20141215-01-security-notice-for-ca-lisa-release-automation.aspx
Third Party Advisory
http://www.kb.cert.org/vuls/id/343060
www.securityfocus.com
http://www.securityfocus.com/archive/1/534246/100/0/threaded
More from Release Automation
9.8
CVE-2018-15691
Insecure deserialization of a specially crafted serialized object, in CA Release Automation 6.5 and earlier, allows attackers to potentially execute arbitrary code
7.1
CVE-2015-8698
CA Release Automation (formerly LISA Release Automation) 5.0.2 before 5.0.2-227, 5.5.1 before 5.5.1-1616, 5.5.2 before 5.5.2-434, and 6.1.0 before 6.1.0-1026 allows remote…
6.1
CVE-2015-8699
Multiple cross-site scripting (XSS) vulnerabilities in CA Release Automation (formerly LISA Release Automation) 5.0.2 before 5.0.2-227, 5.5.1 before 5.5.1-1616, 5.5.2 before…
–
CVE-2014-8248
SQL injection vulnerability in CA Release Automation (formerly iTKO LISA Release Automation) before 4.7.1 b448 allows remote authenticated users to execute arbitrary SQL commands…
–
CVE-2014-8246
Cross-site request forgery (CSRF) vulnerability in CA Release Automation (formerly iTKO LISA Release Automation) before 4.7.1 b448 allows remote attackers to hijack the…