CVE-2014-2936

High

Published: 08/05/2014(UTC)Translated: 17/06/2026(UTC)NVD NIST

Summary

The directory manager in Caldera 9.20 allows remote attackers to conduct variable-injection attacks in the global scope via the maindir_hotfolder parameter to dirmng/index.php or an unspecified parameter to other files.

Risk Assessment

Attackers can exploit this vulnerability to inject malicious data, potentially leading to unauthorized access or data manipulation within the system.

Recommendation

It is recommended to update to the latest version of Caldera and implement appropriate input validation filters in the application.

Other vulnerabilities in Caldera 9.20

CVE-2014-2934High
Multiple SQL injection vulnerabilities in Caldera 9.20 allow remote attackers to execute arbitrary SQL commands via the tr parameter to costview2/jobs.php or costview2/printers.php.

Original NVD description (English source)

The directory manager in Caldera 9.20 allows remote attackers to conduct variable-injection attacks in the global scope via (1) the maindir_hotfolder parameter to dirmng/index.php, or an unspecified parameter to (2) PPD/index.php, (3) dirmng/docmd.php, or (4) dirmng/param.php.