CVE-2014-5108

MEDIUM · 4.3 CVSS Gepubliceerd: 28-07-2014 CWE-79

Beschrijving

Cross-site scripting (XSS) vulnerability in single_pagesdownload_file.php in concrete5 before 5.6.3 allows remote attackers to inject arbitrary web script or HTML via the HTTP Referer header to index.php/download_file.

Vendors

Concrete5 Concretecms

Affected products

Concrete5 Concrete Cms

References

osvdb.org
packetstormsecurity.com
www.securityfocus.com
www.concrete5.org