CVE-2014-2866
HighSummary
PaperThin CommonSpot before 7.0.2 and 8.x before 8.0.3 relies on client JavaScript code for access restrictions, allowing remote attackers to perform unspecified operations by modifying this code.
Risk Assessment
Attackers may exploit this vulnerability to gain control over the application, potentially leading to unauthorized access to data or system functions.
Recommendation
It is recommended to update PaperThin CommonSpot to version 7.0.2 or 8.0.3 and later to mitigate this vulnerability.
Other vulnerabilities in PaperThin CommonSpot
See all- CVE-2014-2874High
PaperThin CommonSpot before 7.0.2 and 8.x before 8.0.3 allows remote attackers to execute arbitrary code via shell metacharacters in an unspecified context.
- CVE-2014-2868High
PaperThin CommonSpot before 7.0.2 and 8.x before 8.0.3 allows remote attackers to modify the flow of execution of ColdFusion code by using an HTTP GET request to set a ColdFusion variable.
- CVE-2014-2867High
In PaperThin CommonSpot before version 7.0.2 and 8.x before version 8.0.3, there is an unrestricted file upload vulnerability that allows remote attackers to execute arbitrary code by uploading a ColdFusion page.
- CVE-2014-2864High
Multiple directory traversal vulnerabilities in PaperThin CommonSpot before 7.0.2 and 8.x before 8.0.3 allow remote attackers to have an unspecified impact via a filename parameter containing directory traversal sequences.
- CVE-2014-2863High
Multiple absolute path traversal vulnerabilities in PaperThin CommonSpot before 7.0.2 and 8.x before 8.0.3 allow remote attackers to have an unspecified impact via a full pathname in a parameter.
- CVE-2014-2859High
PaperThin CommonSpot before 7.0.2 and 8.x before 8.0.3 allows remote attackers to bypass intended access restrictions via a direct request.
Original NVD description (English source)
PaperThin CommonSpot before 7.0.2 and 8.x before 8.0.3 relies on client JavaScript code for access restrictions, which allows remote attackers to perform unspecified operations by modifying this code.