RCE in Paperthin Commonspot Content Server

CVE-2014-2866

PaperThin CommonSpot before 7.0.2 and 8.x before 8.0.3 relies on client JavaScript code for access restrictions, which allows remote attackers to perform unspecified operations by modifying this code.

Vulnerability class: RCE (Remote Code Execution)

EPSS: 0.034 (87.7th percentile) — read the EPSS interpretation.

Affected products

Paperthin Commonspot_content_server — versions 8.0.0, 8.0.1, 8.0.2
N/a — versions n/a

Weakness classification (CWE)

CWE-94 — Code Injection

References

cve@mitre.org (US Government Resource, x_refsource_CERT-VN, third-party-advisory)