CVE-2014-2353 (GCVE-0-2014-2353)

Vulnerability from cvelistv5 – Published: 2014-05-30 23:00 – Updated: 2025-10-03 16:30
VLAI?
Summary
Cross-site scripting (XSS) vulnerability in Cogent DataHub before 7.3.5 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
Severity ?
No CVSS data available.
CWE
Assigner
References
Impacted products
Vendor Product Version
Cogent DataHub Affected: 0 , < 7.3.5 (custom)
Create a notification for this product.
Credits
Alain Homewood
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-06T10:14:25.214Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "http://ics-cert.us-cert.gov/advisories/ICSA-14-149-02"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "DataHub",
          "vendor": "Cogent",
          "versions": [
            {
              "lessThan": "7.3.5",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Alain Homewood"
        }
      ],
      "datePublic": "2014-05-29T06:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003e\nCross-site scripting (XSS) vulnerability in Cogent DataHub before 7.3.5 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.\n\n\u003c/p\u003e"
            }
          ],
          "value": "Cross-site scripting (XSS) vulnerability in Cogent DataHub before 7.3.5 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors."
        }
      ],
      "metrics": [
        {
          "cvssV2_0": {
            "accessComplexity": "MEDIUM",
            "accessVector": "NETWORK",
            "authentication": "NONE",
            "availabilityImpact": "NONE",
            "baseScore": 7.1,
            "confidentialityImpact": "COMPLETE",
            "integrityImpact": "NONE",
            "vectorString": "AV:N/AC:M/Au:N/C:C/I:N/A:N",
            "version": "2.0"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-80",
              "description": "CWE-80",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-10-03T16:30:38.263Z",
        "orgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6",
        "shortName": "icscert"
      },
      "references": [
        {
          "url": "https://www.cisa.gov/news-events/ics-advisories/icsa-14-149-02"
        },
        {
          "url": "http://cogentdatahub.com/Download_Software.html"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eCogent Real-Time Systems, Inc. has produced a new version of the \nCogent DataHub application, Version 7.3.5, that fixes three of the four \nidentified vulnerabilities. The updated version is available at the \nfollowing address:\u003c/p\u003e\n\u003cp\u003e\u003ca target=\"_blank\" rel=\"nofollow\" href=\"http://cogentdatahub.com/Download_Software.html\"\u003ehttp://cogentdatahub.com/Download_Software.html\u003c/a\u003e\u003c/p\u003eCogent\n has indicated that it will not be fixing the cryptographic weaknesses \nof hashed usernames and passwords because of compatibility issues with \nexisting systems. Cogent and the researcher agree that an effective \nmitigation strategy for users is to select sufficiently strong \npasswords. Cogent has indicated that password hashes can be checked for \nstrength using sites such as: \u003ca target=\"_blank\" rel=\"nofollow\" href=\"https://crackstation.net/\"\u003ehttps://crackstation.net/\u003c/a\u003e.\n\n\u003cbr\u003e"
            }
          ],
          "value": "Cogent Real-Time Systems, Inc. has produced a new version of the \nCogent DataHub application, Version 7.3.5, that fixes three of the four \nidentified vulnerabilities. The updated version is available at the \nfollowing address:\n\n\n http://cogentdatahub.com/Download_Software.html \n\nCogent\n has indicated that it will not be fixing the cryptographic weaknesses \nof hashed usernames and passwords because of compatibility issues with \nexisting systems. Cogent and the researcher agree that an effective \nmitigation strategy for users is to select sufficiently strong \npasswords. Cogent has indicated that password hashes can be checked for \nstrength using sites such as:  https://crackstation.net/ ."
        }
      ],
      "source": {
        "advisory": "ICSA-14-149-02",
        "discovery": "EXTERNAL"
      },
      "title": "Cogent DataHub XSS",
      "x_generator": {
        "engine": "Vulnogram 0.2.0"
      },
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "ics-cert@hq.dhs.gov",
          "ID": "CVE-2014-2352",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "n/a",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "n/a"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "Directory traversal vulnerability in Cogent DataHub before 7.3.5 allows remote attackers to read arbitrary files of unspecified types, or cause a web-server denial of service, via a crafted pathname."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "n/a"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "http://ics-cert.us-cert.gov/advisories/ICSA-14-149-02",
              "refsource": "MISC",
              "url": "http://ics-cert.us-cert.gov/advisories/ICSA-14-149-02"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6",
    "assignerShortName": "icscert",
    "cveId": "CVE-2014-2353",
    "datePublished": "2014-05-30T23:00:00",
    "dateReserved": "2014-03-13T00:00:00",
    "dateUpdated": "2025-10-03T16:30:38.263Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1",
  "vulnerability-lookup:meta": {
    "fkie_nvd": {
      "configurations": "[{\"nodes\": [{\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:cogentdatahub:cogent_datahub:*:*:*:*:*:*:*:*\", \"versionEndIncluding\": \"7.3.4\", \"matchCriteriaId\": \"3A416FED-E221-48CE-8AFB-D822C6C8E4FF\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:cogentdatahub:cogent_datahub:7.0:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"D2DE7A08-D283-4EB3-BAAE-0BA4A8C2E088\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:cogentdatahub:cogent_datahub:7.0.2:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"66059E64-6EB2-4F9D-BCB3-099A01C9E72A\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:cogentdatahub:cogent_datahub:7.1.0:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"F05AAB16-437D-4A4E-892B-9B83E47FEC24\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:cogentdatahub:cogent_datahub:7.1.1:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"65D16B36-567F-499D-AC7B-D2CC85AD9327\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:cogentdatahub:cogent_datahub:7.1.1.63:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"D8EC08FD-5473-4DB6-9828-8D007FE1E5FC\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:cogentdatahub:cogent_datahub:7.1.2:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"F2724B2F-49B9-4423-A8D5-95B1E81DDEF9\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:cogentdatahub:cogent_datahub:7.2.2:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"C414FB06-9100-4BB9-9F5C-A31946C11E84\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:cogentdatahub:cogent_datahub:7.3.0:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"D881278E-D6B8-4147-91BA-4EBE049B0C70\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:cogentdatahub:cogent_datahub:7.3.1:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"3142AD5D-E5E1-447B-8FCD-444A31D62437\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:cogentdatahub:cogent_datahub:7.3.2:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"321C4D3C-67FF-4284-A569-8359B58FC2FF\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:cogentdatahub:cogent_datahub:7.3.3:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"0B5C1FCA-D64E-4C12-B3A4-4200F95C6315\"}]}]}]",
      "descriptions": "[{\"lang\": \"en\", \"value\": \"Cross-site scripting (XSS) vulnerability in Cogent DataHub before 7.3.5 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.\"}, {\"lang\": \"es\", \"value\": \"Vulnerabilidad de XSS en Cogent DataHub anterior a 7.3.5 permite a atacantes remotos inyectar secuencias de comandos web o HTML arbitrarios a trav\\u00e9s de vectores no especificados.\"}]",
      "id": "CVE-2014-2353",
      "lastModified": "2024-11-21T02:06:08.160",
      "metrics": "{\"cvssMetricV2\": [{\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"cvssData\": {\"version\": \"2.0\", \"vectorString\": \"AV:N/AC:M/Au:N/C:N/I:P/A:N\", \"baseScore\": 4.3, \"accessVector\": \"NETWORK\", \"accessComplexity\": \"MEDIUM\", \"authentication\": \"NONE\", \"confidentialityImpact\": \"NONE\", \"integrityImpact\": \"PARTIAL\", \"availabilityImpact\": \"NONE\"}, \"baseSeverity\": \"MEDIUM\", \"exploitabilityScore\": 8.6, \"impactScore\": 2.9, \"acInsufInfo\": false, \"obtainAllPrivilege\": false, \"obtainUserPrivilege\": false, \"obtainOtherPrivilege\": false, \"userInteractionRequired\": true}]}",
      "published": "2014-05-30T23:55:02.910",
      "references": "[{\"url\": \"http://ics-cert.us-cert.gov/advisories/ICSA-14-149-02\", \"source\": \"ics-cert@hq.dhs.gov\", \"tags\": [\"US Government Resource\"]}, {\"url\": \"http://ics-cert.us-cert.gov/advisories/ICSA-14-149-02\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"US Government Resource\"]}]",
      "sourceIdentifier": "ics-cert@hq.dhs.gov",
      "vulnStatus": "Modified",
      "weaknesses": "[{\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"description\": [{\"lang\": \"en\", \"value\": \"CWE-79\"}]}]"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2014-2353\",\"sourceIdentifier\":\"ics-cert@hq.dhs.gov\",\"published\":\"2014-05-30T23:55:02.910\",\"lastModified\":\"2025-10-03T17:15:45.290\",\"vulnStatus\":\"Deferred\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"Cross-site scripting (XSS) vulnerability in Cogent DataHub before 7.3.5 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.\"},{\"lang\":\"es\",\"value\":\"Vulnerabilidad de XSS en Cogent DataHub anterior a 7.3.5 permite a atacantes remotos inyectar secuencias de comandos web o HTML arbitrarios a trav\u00e9s de vectores no especificados.\"}],\"metrics\":{\"cvssMetricV2\":[{\"source\":\"ics-cert@hq.dhs.gov\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"2.0\",\"vectorString\":\"AV:N/AC:M/Au:N/C:C/I:N/A:N\",\"baseScore\":7.1,\"accessVector\":\"NETWORK\",\"accessComplexity\":\"MEDIUM\",\"authentication\":\"NONE\",\"confidentialityImpact\":\"COMPLETE\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"NONE\"},\"baseSeverity\":\"HIGH\",\"exploitabilityScore\":8.6,\"impactScore\":6.9,\"acInsufInfo\":false,\"obtainAllPrivilege\":false,\"obtainUserPrivilege\":false,\"obtainOtherPrivilege\":false,\"userInteractionRequired\":true},{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"2.0\",\"vectorString\":\"AV:N/AC:M/Au:N/C:N/I:P/A:N\",\"baseScore\":4.3,\"accessVector\":\"NETWORK\",\"accessComplexity\":\"MEDIUM\",\"authentication\":\"NONE\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"PARTIAL\",\"availabilityImpact\":\"NONE\"},\"baseSeverity\":\"MEDIUM\",\"exploitabilityScore\":8.6,\"impactScore\":2.9,\"acInsufInfo\":false,\"obtainAllPrivilege\":false,\"obtainUserPrivilege\":false,\"obtainOtherPrivilege\":false,\"userInteractionRequired\":true}]},\"weaknesses\":[{\"source\":\"ics-cert@hq.dhs.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-80\"}]},{\"source\":\"nvd@nist.gov\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-79\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:cogentdatahub:cogent_datahub:*:*:*:*:*:*:*:*\",\"versionEndIncluding\":\"7.3.4\",\"matchCriteriaId\":\"3A416FED-E221-48CE-8AFB-D822C6C8E4FF\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:cogentdatahub:cogent_datahub:7.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"D2DE7A08-D283-4EB3-BAAE-0BA4A8C2E088\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:cogentdatahub:cogent_datahub:7.0.2:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"66059E64-6EB2-4F9D-BCB3-099A01C9E72A\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:cogentdatahub:cogent_datahub:7.1.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"F05AAB16-437D-4A4E-892B-9B83E47FEC24\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:cogentdatahub:cogent_datahub:7.1.1:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"65D16B36-567F-499D-AC7B-D2CC85AD9327\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:cogentdatahub:cogent_datahub:7.1.1.63:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"D8EC08FD-5473-4DB6-9828-8D007FE1E5FC\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:cogentdatahub:cogent_datahub:7.1.2:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"F2724B2F-49B9-4423-A8D5-95B1E81DDEF9\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:cogentdatahub:cogent_datahub:7.2.2:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"C414FB06-9100-4BB9-9F5C-A31946C11E84\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:cogentdatahub:cogent_datahub:7.3.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"D881278E-D6B8-4147-91BA-4EBE049B0C70\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:cogentdatahub:cogent_datahub:7.3.1:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"3142AD5D-E5E1-447B-8FCD-444A31D62437\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:cogentdatahub:cogent_datahub:7.3.2:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"321C4D3C-67FF-4284-A569-8359B58FC2FF\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:cogentdatahub:cogent_datahub:7.3.3:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"0B5C1FCA-D64E-4C12-B3A4-4200F95C6315\"}]}]}],\"references\":[{\"url\":\"http://cogentdatahub.com/Download_Software.html\",\"source\":\"ics-cert@hq.dhs.gov\"},{\"url\":\"https://www.cisa.gov/news-events/ics-advisories/icsa-14-149-02\",\"source\":\"ics-cert@hq.dhs.gov\"},{\"url\":\"http://ics-cert.us-cert.gov/advisories/ICSA-14-149-02\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"US Government Resource\"]}]}}"
  }
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Detection rules are retrieved from Rulezet.