Unscored severity · published Jan 21, 2015
CVE-2014-9224
Cross-site scripting (XSS) vulnerability in the ajaxswing webui in the Management Console server in the management server in Symantec Critical System Protection (SCSP) 5.2.9…
–
CVSS
4.6%
EPSS
No
On KEV
Description
Cross-site scripting (XSS) vulnerability in the ajaxswing webui in the Management Console server in the management server in Symantec Critical System Protection (SCSP) 5.2.9 through MP6 and Symantec Data Center Security: Server Advanced (SDCS:SA) 6.0.x through 6.0 MP1 allows remote authenticated users to inject arbitrary web script or HTML via unspecified vectors.
Exploitation
Is it being used?
Exploit prediction (EPSS)4.6% · higher than 92% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
DC
Data Center Security · Symantec
6.0.0 · source: NVD
SC
Symantec Critical System Protection · Broadcom
5.2.9 · source: NVD
Affected product
SC
Symantec Critical System Protection
Broadcom
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2014-9224
CVE.org
https://www.cve.org/CVERecord?id=CVE-2014-9224
packetstormsecurity.com
http://packetstormsecurity.com/files/130060/Symantec-SDCS-SA-SCSP-XSS-Bypass-SQL-Injection-Disclosure.html
seclists.org
http://seclists.org/fulldisclosure/2015/Jan/91
www.securityfocus.com
http://www.securityfocus.com/archive/1/534527/100/0/threaded
www.securityfocus.com
http://www.securityfocus.com/bid/72093
Vendor Advisory
http://www.symantec.com/security_response/securityupdates/detail.jsp?fid=security_advisory&pvid=security_advisory&year=&suid=20150119_00
More from Symantec Critical System Protection
9.8
CVE-2019-18374
Symantec Critical System Protection (CSP), versions 8.0, 8.0 HF1 & 8.0 MP1, may be susceptible to an authentication bypass vulnerability, which is a type of issue that can…
8.8
CVE-2015-8157
SQL injection vulnerability in the Management Server in Symantec Embedded Security: Critical System Protection (SES:CSP) 1.0.x before 1.0 MP5, Embedded Security: Critical System…
8.0
CVE-2015-8798
Directory traversal vulnerability in the Management Server in Symantec Embedded Security: Critical System Protection (SES:CSP) 1.0.x before 1.0 MP5, Embedded Security: Critical…
7.6
CVE-2015-8799
Directory traversal vulnerability in the Management Server in Symantec Embedded Security: Critical System Protection (SES:CSP) 1.0.x before 1.0 MP5, Embedded Security: Critical…
7.3
CVE-2015-8800
Symantec Embedded Security: Critical System Protection (SES:CSP) 1.0.x before 1.0 MP5, Embedded Security: Critical System Protection for Controllers and Devices (SES:CSP) 6.5.0…