CVE-2014-3207

Sks Keyserver < 1.1.4 - XSS

Title source: rule

Description

Cross-site scripting (XSS) vulnerability in wserver.ml in SKS Keyserver before 1.1.5 allows remote attackers to inject arbitrary web script or HTML via the PATH_INFO to pks/lookup/undefined1.

References (5)

[Vendor Advisory] http://secunia.com/advisories/57965

[Third Party Advisory, VDB Entry] http://www.securityfocus.com/bid/67198

[Exploit, Patch] https://bitbucket.org/skskeyserver/sks-keyserver/commits/88d453cdc858d1352c61a4d4a6cd5b1ac17f2724

[Exploit] https://bitbucket.org/skskeyserver/sks-keyserver/issue/26/unfiltered-xss

[Issue Tracking] https://bugzilla.mozilla.org/show_bug.cgi?id=952077

Scores

EPSS 0.0031

EPSS Percentile 53.5%

Details

CWE

CWE-79

Status published

Products (13)

sks_keyserver_project/sks_keyserver < 1.1.4

sks_keyserver_project/sks_keyserver

... and 3 more

Published May 08, 2014

Tracked Since Feb 18, 2026