Description

Cross-site scripting (XSS) vulnerability in single_pages\download_file.php in concrete5 before 5.6.3 allows remote attackers to inject arbitrary web script or HTML via the HTTP Referer header to index.php/download_file.

Remediation

References

CVE-2014-5108

Related Vulnerabilities

WordPress Plugin GenerateBlocks Cross-Site Scripting (1.3.5)

WordPress Plugin Photo Gallery by 10Web-Mobile-Friendly Image Gallery Unspecified Vulnerability (1.2.100)

WordPress Plugin BuddyPress Security Bypass (2.3.4)

WordPress Plugin WP Forum Multiple Security Vulnerbilities (1.7.8)

WordPress Plugin LearnDash LMS Multiple Information Disclosure Vulnerabilities (4.10.2)

Severity

Medium

Tags

Missing Update Known Vulnerabilities CWE-707 CVE-2014-5108