CVE-2014-4312

NONE

Published Oct 10, 201411y ago · Modified Jun 17, 20262w ago

Published Oct 10, 2014 11y ago

Last Modified Jun 17, 2026 2w ago

Description

Multiple cross-site scripting (XSS) vulnerabilities in Epicor Enterprise 7.4 before FS74SP6_HotfixTL054181 allow remote attackers to inject arbitrary web script or HTML via the (1) Notes section to Order details; (2) Description section to "Order to consume"; (3) Favorites name section to Favorites; (4) FiltKeyword parameter to Procurement/EKPHTML/search_item_bt.asp; (5) Act parameter to Procurement/EKPHTML/EnterpriseManager/Budget/ImportBudget_fr.asp; (6) hdnOpener or (7) hdnApproverFieldName parameter to Procurement/EKPHTML/EnterpriseManager/UserSearchDlg.asp; or (8) INTEGRATED parameter to Procurement/EKPHTML/EnterpriseManager/Codes.asp.

Threat Intelligence

No active exploitation signals — not in CISA KEV and no EPSS score yet.

Exploit & Patch Status

Public Exploit Known

No Patch Available

Weaknesses 1

CWE-79 Cross-site Scripting Injection

Affected Products 1

Vendor	Product	Version	Range
epicor	epicor_enterprise	*	≤7.4

References 12

osvdb.org http://osvdb.org/show/osvdb/112464
osvdb.org http://osvdb.org/show/osvdb/112465
osvdb.org http://osvdb.org/show/osvdb/112466
osvdb.org http://osvdb.org/show/osvdb/112467
osvdb.org http://osvdb.org/show/osvdb/112469
osvdb.org http://osvdb.org/show/osvdb/112470
osvdb.org http://osvdb.org/show/osvdb/112471
packetstormsecurity.com http://packetstormsecurity.com/files/128511/Epicor-Password-Disclosure-Cross-Site-Scripting.html

Exploit
seclists.org http://seclists.org/fulldisclosure/2014/Oct/2

Exploit
exploit-db.com http://www.exploit-db.com/exploits/34864

Exploit
securityfocus.com http://www.securityfocus.com/bid/70192

Exploit
exchange.xforce.ibmcloud.com https://exchange.xforce.ibmcloud.com/vulnerabilities/96793

Remediation

No remediation data recorded yet

Check vendor advisories and the NVD entry for patch availability.