CVE-2014-2879

MEDIUM 4.3CVE-2014-2879 · Published 17/04/2014 · updated 17/06/2026

In short

CVE-2014-2879 is a MEDIUM (CVSS 4.3) vulnerability affecting email security appliance (sonicwall).
Chance of exploitation in the next 30 days (EPSS): 4.8%, higher than 92.0% of all vulnerabilities.
No patched version is listed yet: follow the vendor's advisory in References.

Package	Affected versions	Patched versions
email security appliance sonicwall	`≤ 7.4.5`	No fix yet

Description

Multiple cross-site scripting (XSS) vulnerabilities in Dell SonicWALL Email Security 7.4.5 and earlier allow remote authenticated administrators to inject arbitrary web script or HTML via (1) the uploadPatch parameter to the System/Advanced page (settings_advanced.html) or (2) the uploadLicenses parameter in the License management (settings_upload_dlicense.html) page.

References

seclists.org/fulldisclosure/2014/Mar/409 · Exploit
securityfocus.com/archive/1/531642/100/0/threaded
securityfocus.com/bid/66501 · Third Party Advisory
securitytracker.com/id/1029965 · Third Party Advisory
sonicwall.com/us/shared/download/Support-Bulletin_Email-Security_Scripting_Vulnerability__Resolved_in__ES746.pdf · Broken Link
vulnerability-lab.com/get_content.php · Exploit

More vulnerabilities in email security appliance

See all →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free