CVE-2014-5326: Cross-Site Scripting Vulnerability in Direct Web Remoting (DWR)
Summary
CVE-2014-5326: Improper Neutralization of Input During Web Page Generation in Direct Web Remoting. Affects org.directwebremoting:dwr across 2 version ranges.
< 2.0.11
>= 3.0.M1, < 3.0.RC3
Fixed in 2.0.11 or 3.0.RC3, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Direct Web Remoting (DWR) is a library that enables Java developers to write Ajax web applications. It provides an easy way to call Java code from JavaScript and vice versa. DWR versions up to 2.0.10 and 3.x up to 3.0.RC2 are affected by a cross-site scripting (XSS) vulnerability.
Vulnerability Detail
The vulnerability allows remote attackers to inject arbitrary web script or HTML into web pages generated by DWR. This can lead to various attacks, such as stealing sensitive information, performing actions on behalf of the user, or defacing the website. The exact vectors of the attack are unspecified.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
< 2.0.112.0.11 -
>= 3.0.M1, < 3.0.RC33.0.RC3
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability. It is advised to update to the fixed versions as mentioned in the 'how_to_fix' section.
Conclusion
The cross-site scripting vulnerability in Direct Web Remoting (DWR) can have serious security implications. It is crucial to update to the fixed versions mentioned in the 'how_to_fix' section to mitigate the risk. For further support on vulnerability remediation, you can contact DevNack.com.
See every vulnerability recorded for org.directwebremoting:dwr →
FAQ
The vulnerability allows attackers to inject malicious scripts or HTML into web pages, potentially leading to various attacks such as stealing sensitive information or performing actions on behalf of the user.
You can use Vulert Playground (https://vulert.com/scanner) to check if your application is affected by this vulnerability. Simply provide your pom.xml file, and Vulert will analyze it in real-time.
No, only versions up to 2.0.10 and 3.x up to 3.0.RC2 are affected. Versions 2.0.11 and 3.0.RC3 or later have the vulnerability fixed.
The exact vectors of the attack are unspecified, but it is a known vulnerability. It is recommended to update to the fixed versions to mitigate the risk.
You can find more information about this vulnerability in the GitHub Advisory Database: [link to the advisory]
References
Related vulnerabilities
Recent vulnerabilities recorded for org.directwebremoting:dwr.
