CVE-2014-4406

MEDIUM

Apple OS X Server <3.2.1 - XSS

Title source: llm

Description

Cross-site scripting (XSS) vulnerability in Xcode Server in CoreCollaboration in Apple OS X Server before 3.2.1 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.

References (8)

[Third Party Advisory] http://archives.neohapsis.com/archives/bugtraq/2014-10/0103.html

[Vendor Advisory] http://support.apple.com/kb/HT6448

[Various Sources] http://www.cloudscan.me/2014/09/cve-2014-4406-apple-sa-2014-09-17-5-os.html

[Third Party Advisory, VDB Entry] http://www.securitytracker.com/id/1030870

[Third Party Advisory, VDB Entry] https://exchange.xforce.ibmcloud.com/vulnerabilities/96047

[Vendor Advisory] https://support.apple.com/kb/HT6536

[Third Party Advisory, VDB Entry] http://www.securityfocus.com/bid/69935

[Third Party Advisory] http://secunia.com/advisories/61307

Scores

CVSS v3 6.1

EPSS 0.0057

EPSS Percentile 68.3%

Attack Vector NETWORK

CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Classification

CWE

CWE-79

Status draft

Affected Products (13)

apple/os_x_server < 3.1.2

apple/os_x_server

Timeline

Published Sep 19, 2014

Tracked Since Feb 18, 2026