Description

Cross-site scripting (XSS) vulnerability in single_pages\download_file.php in concrete5 before 5.6.3 allows remote attackers to inject arbitrary web script or HTML via the HTTP Referer header to index.php/download_file.

Remediation

References

CVE-2014-5108

Related Vulnerabilities

Joomla! Core 3.x.x Cross-Site Scripting (3.2.0 - 3.9.3)

MySQL Other Vulnerability (CVE-2001-1275)

Apache Tomcat Other Vulnerability (CVE-2005-2090)

mod_ssl Other Vulnerability (CVE-2002-0082)

WordPress Plugin PayPlus Payment Gateway SQL Injection (7.0.7)

Severity

Medium

Classification

CVE-2014-5108 CWE-707

Tags

Missing Update Known Vulnerabilities