CVE-2014-2966 Security feature bypass in n/a
Remote attackers can bypass XSS protection mechanisms in Resin Pro by exploiting improper Unicode transformations in the ISO-8859-1 encoder.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2014-2966?
CVE-2014-2966 is a medium-severity vulnerability in n/a, published on 26 Jul 2014. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
The ISO-8859-1 encoder in Resin Pro before 4.0.40 does not properly perform Unicode transformations, which allows remote attackers to bypass intended text restrictions via crafted characters, as demonstrated by bypassing an XSS protection mechanism.
Which versions are affected by CVE-2014-2966?
It affects 1 product.
Products include Caucho Resin.
How do I fix CVE-2014-2966?
No fix has been published for CVE-2014-2966 yet. Limit exposure of the affected software until one is available.
Is CVE-2014-2966 being exploited?
There is no known exploitation of CVE-2014-2966 in the wild and no public exploit code.
Other vulnerabilities in n/a
- CVE-2021-44138 Path Traversal in Caucho Resin
- CVE-2012-2965 Caucho Quercus, as distributed in Resin, does not properly handle unspecified characters in the names of variables
- CVE-2012-2966 Caucho Quercus, as distributed in Resin, overwrites entries in SERVER superglobal array on basis of POST parameters
- CVE-2012-2967 Caucho Quercus, as distributed in Resin, does not properly implement the `==` operator for comparisons
- CVE-2012-2969 Path traversal in n/a
Sources
Also known as GHSA-3ff8-cpmw-v77w.