{"api_version":"1","generated_at":"2026-07-24T20:49:22+00:00","cve":"CVE-2014-3808","urls":{"html":"https://cve.report/CVE-2014-3808","api":"https://cve.report/api/cve/CVE-2014-3808.json","docs":"https://cve.report/api","cve_org":"https://www.cve.org/CVERecord?id=CVE-2014-3808","nvd":"https://nvd.nist.gov/vuln/detail/CVE-2014-3808"},"summary":{"title":"CVE-2014-3808","description":"Multiple cross-site scripting (XSS) vulnerabilities in BarracudaDrive before 6.7.2 allow remote attackers to inject arbitrary web script or HTML via the (1) role parameter to roles.lsp, (2) name parameter to user.lsp, (3) path parameter to wizard/setuser.lsp, (4) host parameter to tunnelconstr.lsp, or (5) newpath parameter to wfsconstr.lsp in rtl/protected/admin/.","state":"PUBLISHED","assigner":"mitre","published_at":"2014-05-21 14:55:06","updated_at":"2026-05-06 22:30:45"},"problem_types":["CWE-79","n/a"],"metrics":[{"version":"2.0","source":"nvd@nist.gov","type":"Primary","score":"4.3","severity":"","vector":"AV:N/AC:M/Au:N/C:N/I:P/A:N","data":{"version":"2.0","vectorString":"AV:N/AC:M/Au:N/C:N/I:P/A:N","baseScore":4.3,"accessVector":"NETWORK","accessComplexity":"MEDIUM","authentication":"NONE","confidentialityImpact":"NONE","integrityImpact":"PARTIAL","availabilityImpact":"NONE"}}],"references":[{"url":"http://secpod.org/advisories/SecPod_Advistory_BarracudaDrive_6.7.1_Mult_XSS_Vuln.txt","name":"http://secpod.org/advisories/SecPod_Advistory_BarracudaDrive_6.7.1_Mult_XSS_Vuln.txt","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Exploit"],"title":"404 Not Found","mime":"text/html","httpstatus":"404","archivestatus":"404"},{"url":"http://secpod.org/blog/?p=2309","name":"http://secpod.org/blog/?p=2309","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"404 Not Found","mime":"text/html","httpstatus":"404","archivestatus":"404"},{"url":"http://secunia.com/advisories/58309","name":"http://secunia.com/advisories/58309","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"Security Advisory SA58309 - BarracudaDrive Two Cross-Site Scripting Vulnerabilities - Secunia","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://www.securityfocus.com/bid/67138","name":"http://www.securityfocus.com/bid/67138","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"BarracudaDrive Multiple Cross Site Scripting and HTML Injection Vulnerabilities","mime":"text/html","httpstatus":"200","archivestatus":"0"},{"url":"https://www.cve.org/CVERecord?id=CVE-2014-3808","name":"CVE Program record","refsource":"CVE.ORG","tags":["canonical"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2014-3808","name":"NVD vulnerability detail","refsource":"NVD","tags":["canonical","analysis"]}],"affected":[{"source":"CNA","vendor":"n/a","product":"n/a","version":"affected n/a","platforms":[]}],"timeline":[],"solutions":[],"workarounds":[],"exploits":[],"credits":[],"nvd_cpes":[{"cve_year":"2014","cve_id":"3808","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"barracudadrive","cpe5":"barracudadrive","cpe6":"6.0","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2014","cve_id":"3808","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"barracudadrive","cpe5":"barracudadrive","cpe6":"6.1","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2014","cve_id":"3808","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"barracudadrive","cpe5":"barracudadrive","cpe6":"6.2","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2014","cve_id":"3808","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"barracudadrive","cpe5":"barracudadrive","cpe6":"6.3","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2014","cve_id":"3808","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"barracudadrive","cpe5":"barracudadrive","cpe6":"6.4","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2014","cve_id":"3808","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"barracudadrive","cpe5":"barracudadrive","cpe6":"6.6","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2014","cve_id":"3808","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"barracudadrive","cpe5":"barracudadrive","cpe6":"6.7","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2014","cve_id":"3808","vulnerable":"1","versionEndIncluding":"6.7.1","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"barracudadrive","cpe5":"barracudadrive","cpe6":"*","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2014","cve_id":"3808","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"realtimelogic","cpe5":"barracudadrive","cpe6":"6.5","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"}],"vendor_comments":[],"enrichments":{"kev":null,"epss":null,"legacy_qids":[]},"source_records":{"cve_program":{"containers":{"adp":[{"providerMetadata":{"dateUpdated":"2024-08-06T10:57:17.575Z","orgId":"af854a3a-2127-422b-91ae-364da2661108","shortName":"CVE"},"references":[{"name":"58309","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred"],"url":"http://secunia.com/advisories/58309"},{"name":"67138","tags":["vdb-entry","x_refsource_BID","x_transferred"],"url":"http://www.securityfocus.com/bid/67138"},{"tags":["x_refsource_MISC","x_transferred"],"url":"http://secpod.org/blog/?p=2309"},{"tags":["x_refsource_MISC","x_transferred"],"url":"http://secpod.org/advisories/SecPod_Advistory_BarracudaDrive_6.7.1_Mult_XSS_Vuln.txt"}],"title":"CVE Program Container"}],"cna":{"affected":[{"product":"n/a","vendor":"n/a","versions":[{"status":"affected","version":"n/a"}]}],"datePublic":"2014-04-28T00:00:00.000Z","descriptions":[{"lang":"en","value":"Multiple cross-site scripting (XSS) vulnerabilities in BarracudaDrive before 6.7.2 allow remote attackers to inject arbitrary web script or HTML via the (1) role parameter to roles.lsp, (2) name parameter to user.lsp, (3) path parameter to wizard/setuser.lsp, (4) host parameter to tunnelconstr.lsp, or (5) newpath parameter to wfsconstr.lsp in rtl/protected/admin/."}],"problemTypes":[{"descriptions":[{"description":"n/a","lang":"en","type":"text"}]}],"providerMetadata":{"dateUpdated":"2015-05-04T16:57:01.000Z","orgId":"8254265b-2729-46b6-b9e3-3dfca2d5bfca","shortName":"mitre"},"references":[{"name":"58309","tags":["third-party-advisory","x_refsource_SECUNIA"],"url":"http://secunia.com/advisories/58309"},{"name":"67138","tags":["vdb-entry","x_refsource_BID"],"url":"http://www.securityfocus.com/bid/67138"},{"tags":["x_refsource_MISC"],"url":"http://secpod.org/blog/?p=2309"},{"tags":["x_refsource_MISC"],"url":"http://secpod.org/advisories/SecPod_Advistory_BarracudaDrive_6.7.1_Mult_XSS_Vuln.txt"}],"x_legacyV4Record":{"CVE_data_meta":{"ASSIGNER":"cve@mitre.org","ID":"CVE-2014-3808","STATE":"PUBLIC"},"affects":{"vendor":{"vendor_data":[{"product":{"product_data":[{"product_name":"n/a","version":{"version_data":[{"version_value":"n/a"}]}}]},"vendor_name":"n/a"}]}},"data_format":"MITRE","data_type":"CVE","data_version":"4.0","description":{"description_data":[{"lang":"eng","value":"Multiple cross-site scripting (XSS) vulnerabilities in BarracudaDrive before 6.7.2 allow remote attackers to inject arbitrary web script or HTML via the (1) role parameter to roles.lsp, (2) name parameter to user.lsp, (3) path parameter to wizard/setuser.lsp, (4) host parameter to tunnelconstr.lsp, or (5) newpath parameter to wfsconstr.lsp in rtl/protected/admin/."}]},"problemtype":{"problemtype_data":[{"description":[{"lang":"eng","value":"n/a"}]}]},"references":{"reference_data":[{"name":"58309","refsource":"SECUNIA","url":"http://secunia.com/advisories/58309"},{"name":"67138","refsource":"BID","url":"http://www.securityfocus.com/bid/67138"},{"name":"http://secpod.org/blog/?p=2309","refsource":"MISC","url":"http://secpod.org/blog/?p=2309"},{"name":"http://secpod.org/advisories/SecPod_Advistory_BarracudaDrive_6.7.1_Mult_XSS_Vuln.txt","refsource":"MISC","url":"http://secpod.org/advisories/SecPod_Advistory_BarracudaDrive_6.7.1_Mult_XSS_Vuln.txt"}]}}}},"cveMetadata":{"assignerOrgId":"8254265b-2729-46b6-b9e3-3dfca2d5bfca","assignerShortName":"mitre","cveId":"CVE-2014-3808","datePublished":"2014-05-21T14:00:00.000Z","dateReserved":"2014-05-21T00:00:00.000Z","dateUpdated":"2024-08-06T10:57:17.575Z","state":"PUBLISHED"},"dataType":"CVE_RECORD","dataVersion":"5.1"},"nvd":{"publishedDate":"2014-05-21 14:55:06","lastModifiedDate":"2026-05-06 22:30:45","problem_types":["CWE-79","n/a"],"metrics":{"cvssMetricV2":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"2.0","vectorString":"AV:N/AC:M/Au:N/C:N/I:P/A:N","baseScore":4.3,"accessVector":"NETWORK","accessComplexity":"MEDIUM","authentication":"NONE","confidentialityImpact":"NONE","integrityImpact":"PARTIAL","availabilityImpact":"NONE"},"baseSeverity":"MEDIUM","exploitabilityScore":8.6,"impactScore":2.9,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":true}]},"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:barracudadrive:barracudadrive:*:*:*:*:*:*:*:*","versionEndIncluding":"6.7.1","matchCriteriaId":"0FE02DBE-3102-4216-8C27-E6730C870B06"},{"vulnerable":true,"criteria":"cpe:2.3:a:barracudadrive:barracudadrive:6.0:*:*:*:*:*:*:*","matchCriteriaId":"919AC781-2DD8-4909-A177-609BA65A4ED5"},{"vulnerable":true,"criteria":"cpe:2.3:a:barracudadrive:barracudadrive:6.1:*:*:*:*:*:*:*","matchCriteriaId":"3F5D889C-4519-4D6A-B6B7-E650CC190F34"},{"vulnerable":true,"criteria":"cpe:2.3:a:barracudadrive:barracudadrive:6.2:*:*:*:*:*:*:*","matchCriteriaId":"DBCD594B-5B54-4E9C-AF33-3480DDAD4AD0"},{"vulnerable":true,"criteria":"cpe:2.3:a:barracudadrive:barracudadrive:6.3:*:*:*:*:*:*:*","matchCriteriaId":"B0E480CA-694D-4590-9752-E39B7FA8E07C"},{"vulnerable":true,"criteria":"cpe:2.3:a:barracudadrive:barracudadrive:6.4:*:*:*:*:*:*:*","matchCriteriaId":"3E1EA8D1-FD78-4830-8377-31C89A418E3C"},{"vulnerable":true,"criteria":"cpe:2.3:a:barracudadrive:barracudadrive:6.6:*:*:*:*:*:*:*","matchCriteriaId":"793D66D8-405F-4B9F-BF5A-169BF813DAB5"},{"vulnerable":true,"criteria":"cpe:2.3:a:barracudadrive:barracudadrive:6.7:*:*:*:*:*:*:*","matchCriteriaId":"F1E66E5B-C2EE-422D-A212-EF02A4FAFC91"},{"vulnerable":true,"criteria":"cpe:2.3:a:realtimelogic:barracudadrive:6.5:*:*:*:*:*:*:*","matchCriteriaId":"1B62D976-878B-4D55-9739-0C95E9EF7183"}]}]}]},"legacy_mitre":{"record":{"CveYear":"2014","CveId":"3808","Ordinal":"1","Title":"CVE-2014-3808","CVE":"CVE-2014-3808","Year":"2014"},"notes":[{"CveYear":"2014","CveId":"3808","Ordinal":"1","NoteData":"Multiple cross-site scripting (XSS) vulnerabilities in BarracudaDrive before 6.7.2 allow remote attackers to inject arbitrary web script or HTML via the (1) role parameter to roles.lsp, (2) name parameter to user.lsp, (3) path parameter to wizard/setuser.lsp, (4) host parameter to tunnelconstr.lsp, or (5) newpath parameter to wfsconstr.lsp in rtl/protected/admin/.","Type":"Description","Title":"CVE-2014-3808"},{"CveYear":"2014","CveId":"3808","Ordinal":"2","NoteData":"2014-05-21","Type":"Other","Title":"Published"},{"CveYear":"2014","CveId":"3808","Ordinal":"3","NoteData":"2015-05-04","Type":"Other","Title":"Modified"}]}}}