medium4.3
CVE-2014-5326
Improper Neutralization of Input During Web Page Generation in Direct Web Remoting
Impact
Cross-site scripting (XSS) vulnerability in Direct Web Remoting (DWR) through 2.0.10 and 3.x through 3.0.RC2 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| maven | org.directwebremoting:dwr | < 2.0.11 | 2.0.11 |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Directwebremoting | Direct Web Remoting | through 2.0.10 Version 3.0 |