FKIE_CVE-2014-4312

Vulnerability from fkie_nvd - Published: 2014-10-10 14:55 - Updated: 2026-06-17 00:09
Severity
Summary
Multiple cross-site scripting (XSS) vulnerabilities in Epicor Enterprise 7.4 before FS74SP6_HotfixTL054181 allow remote attackers to inject arbitrary web script or HTML via the (1) Notes section to Order details; (2) Description section to "Order to consume"; (3) Favorites name section to Favorites; (4) FiltKeyword parameter to Procurement/EKPHTML/search_item_bt.asp; (5) Act parameter to Procurement/EKPHTML/EnterpriseManager/Budget/ImportBudget_fr.asp; (6) hdnOpener or (7) hdnApproverFieldName parameter to Procurement/EKPHTML/EnterpriseManager/UserSearchDlg.asp; or (8) INTEGRATED parameter to Procurement/EKPHTML/EnterpriseManager/Codes.asp.
References
cve@mitre.orghttp://osvdb.org/show/osvdb/112464
cve@mitre.orghttp://osvdb.org/show/osvdb/112465
cve@mitre.orghttp://osvdb.org/show/osvdb/112466
cve@mitre.orghttp://osvdb.org/show/osvdb/112467
cve@mitre.orghttp://osvdb.org/show/osvdb/112469
cve@mitre.orghttp://osvdb.org/show/osvdb/112470
cve@mitre.orghttp://osvdb.org/show/osvdb/112471
cve@mitre.orghttp://packetstormsecurity.com/files/128511/Epicor-Password-Disclosure-Cross-Site-Scripting.htmlExploit
cve@mitre.orghttp://seclists.org/fulldisclosure/2014/Oct/2Exploit
cve@mitre.orghttp://www.exploit-db.com/exploits/34864Exploit
cve@mitre.orghttp://www.securityfocus.com/bid/70192Exploit
cve@mitre.orghttps://exchange.xforce.ibmcloud.com/vulnerabilities/96793
af854a3a-2127-422b-91ae-364da2661108http://osvdb.org/show/osvdb/112464
af854a3a-2127-422b-91ae-364da2661108http://osvdb.org/show/osvdb/112465
af854a3a-2127-422b-91ae-364da2661108http://osvdb.org/show/osvdb/112466
af854a3a-2127-422b-91ae-364da2661108http://osvdb.org/show/osvdb/112467
af854a3a-2127-422b-91ae-364da2661108http://osvdb.org/show/osvdb/112469
af854a3a-2127-422b-91ae-364da2661108http://osvdb.org/show/osvdb/112470
af854a3a-2127-422b-91ae-364da2661108http://osvdb.org/show/osvdb/112471
af854a3a-2127-422b-91ae-364da2661108http://packetstormsecurity.com/files/128511/Epicor-Password-Disclosure-Cross-Site-Scripting.htmlExploit
af854a3a-2127-422b-91ae-364da2661108http://seclists.org/fulldisclosure/2014/Oct/2Exploit
af854a3a-2127-422b-91ae-364da2661108http://www.exploit-db.com/exploits/34864Exploit
af854a3a-2127-422b-91ae-364da2661108http://www.securityfocus.com/bid/70192Exploit
af854a3a-2127-422b-91ae-364da2661108https://exchange.xforce.ibmcloud.com/vulnerabilities/96793
Impacted products
Vendor Product Version
epicor epicor_enterprise *
To clipboard 

{
  "affected": [
    {
      "affectedData": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "source": "cve@mitre.org"
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:epicor:epicor_enterprise:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "1F9BA86D-F7A9-4908-92E5-0705488CA6F3",
              "versionEndIncluding": "7.4",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Multiple cross-site scripting (XSS) vulnerabilities in Epicor Enterprise 7.4 before FS74SP6_HotfixTL054181 allow remote attackers to inject arbitrary web script or HTML via the (1) Notes section to Order details; (2) Description section to \"Order to consume\"; (3) Favorites name section to Favorites; (4) FiltKeyword parameter to Procurement/EKPHTML/search_item_bt.asp; (5) Act parameter to Procurement/EKPHTML/EnterpriseManager/Budget/ImportBudget_fr.asp; (6) hdnOpener or (7) hdnApproverFieldName parameter to Procurement/EKPHTML/EnterpriseManager/UserSearchDlg.asp; or (8) INTEGRATED parameter to Procurement/EKPHTML/EnterpriseManager/Codes.asp."
    },
    {
      "lang": "es",
      "value": "M\u00faltiples vulnerabilidades de XSS en Epicor Enterprise 7.4 anterior a FS74SP6_HotfixTL054181 permiten a atacantes remotos inyectar secuencias de comandos web o HTML arbitrarios a trav\u00e9s de (1) la secci\u00f3n de notas en los detalles del pedido; (2) la secci\u00f3n de descripci\u00f3n en \u0027pedir para consumir\u0027; (3) la secci\u00f3n de nombres de favoritos en Favoritos; (4) el par\u00e1metro FiltKeyword en Procurement/EKPHTML/search_item_bt.asp; (5) el par\u00e1metro Act en Procurement/EKPHTML/EnterpriseManager/Budget/ImportBudget_fr.asp; (6) hdnOpener o (7) el par\u00e1metro hdnApproverFieldName en Procurement/EKPHTML/EnterpriseManager/UserSearchDlg.asp; o (8) el par\u00e1metro INTEGRATED en Procurement/EKPHTML/EnterpriseManager/Codes.asp."
    }
  ],
  "id": "CVE-2014-4312",
  "lastModified": "2026-06-17T00:09:48.100",
  "metrics": {
    "cvssMetricV2": [
      {
        "acInsufInfo": false,
        "baseSeverity": "MEDIUM",
        "cvssData": {
          "accessComplexity": "MEDIUM",
          "accessVector": "NETWORK",
          "authentication": "NONE",
          "availabilityImpact": "NONE",
          "baseScore": 4.3,
          "confidentialityImpact": "NONE",
          "integrityImpact": "PARTIAL",
          "vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N",
          "version": "2.0"
        },
        "exploitabilityScore": 8.6,
        "impactScore": 2.9,
        "obtainAllPrivilege": false,
        "obtainOtherPrivilege": false,
        "obtainUserPrivilege": false,
        "source": "nvd@nist.gov",
        "type": "Primary",
        "userInteractionRequired": true
      }
    ]
  },
  "published": "2014-10-10T14:55:07.977",
  "references": [
    {
      "source": "cve@mitre.org",
      "url": "http://osvdb.org/show/osvdb/112464"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://osvdb.org/show/osvdb/112465"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://osvdb.org/show/osvdb/112466"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://osvdb.org/show/osvdb/112467"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://osvdb.org/show/osvdb/112469"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://osvdb.org/show/osvdb/112470"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://osvdb.org/show/osvdb/112471"
    },
    {
      "source": "cve@mitre.org",
      "tags": [
        "Exploit"
      ],
      "url": "http://packetstormsecurity.com/files/128511/Epicor-Password-Disclosure-Cross-Site-Scripting.html"
    },
    {
      "source": "cve@mitre.org",
      "tags": [
        "Exploit"
      ],
      "url": "http://seclists.org/fulldisclosure/2014/Oct/2"
    },
    {
      "source": "cve@mitre.org",
      "tags": [
        "Exploit"
      ],
      "url": "http://www.exploit-db.com/exploits/34864"
    },
    {
      "source": "cve@mitre.org",
      "tags": [
        "Exploit"
      ],
      "url": "http://www.securityfocus.com/bid/70192"
    },
    {
      "source": "cve@mitre.org",
      "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/96793"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://osvdb.org/show/osvdb/112464"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://osvdb.org/show/osvdb/112465"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://osvdb.org/show/osvdb/112466"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://osvdb.org/show/osvdb/112467"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://osvdb.org/show/osvdb/112469"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://osvdb.org/show/osvdb/112470"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://osvdb.org/show/osvdb/112471"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Exploit"
      ],
      "url": "http://packetstormsecurity.com/files/128511/Epicor-Password-Disclosure-Cross-Site-Scripting.html"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Exploit"
      ],
      "url": "http://seclists.org/fulldisclosure/2014/Oct/2"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Exploit"
      ],
      "url": "http://www.exploit-db.com/exploits/34864"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Exploit"
      ],
      "url": "http://www.securityfocus.com/bid/70192"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/96793"
    }
  ],
  "sourceIdentifier": "cve@mitre.org",
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-79"
        }
      ],
      "source": "nvd@nist.gov",
      "type": "Primary"
    }
  ]
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.