CVE-2014-3877
Incomplete blacklist vulnerability in Frams' Fast File EXchange (F*EX, aka fex) before fex...
Incomplete blacklist vulnerability in Frams' Fast File EXchange (F*EX, aka fex) before fex-20140530 allows remote attackers to conduct cross-site scripting (XSS) attacks via the addto parameter to fup.
Exploit likelihood
What each source reports
NVD Score used
Incomplete blacklist vulnerability in Frams' Fast File EXchange (F*EX, aka fex) before fex-20140530 allows remote attackers to conduct cross-site scripting (XSS) attacks via the addto parameter to fup.
- Record
CVE-2014-3877- CVSS 2.0
- 4.3 Medium
AV:N/AC:M/Au:N/C:N/I:P/A:N - Updated
- 2026-11-02
CVE List No score
Incomplete blacklist vulnerability in Frams' Fast File EXchange (F*EX, aka fex) before fex-20140530 allows remote attackers to conduct cross-site scripting (XSS) attacks via the addto parameter to fup.
- Record
CVE-2014-3877- Updated
- 2026-11-02
EUVDEUVD-2014-3814 No score
Incomplete blacklist vulnerability in Frams' Fast File EXchange (F*EX, aka fex) before fex-20140530 allows remote attackers to conduct cross-site scripting (XSS) attacks via the addto parameter to fup.
- Record
EUVD-2014-3814- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-8g57-j3c3-fvfv No score
Incomplete blacklist vulnerability in Frams' Fast File EXchange (F*EX, aka fex) before fex...
Incomplete blacklist vulnerability in Frams' Fast File EXchange (F*EX, aka fex) before fex-20140530 allows remote attackers to conduct cross-site scripting (XSS) attacks via the addto parameter to fup.
- Record
GHSA-8g57-j3c3-fvfv- Updated
- 2026-11-02
OSV No score
Incomplete blacklist vulnerability in Frams' Fast File EXchange (F*EX, aka fex) before fex-20140530 allows remote attackers to conduct cross-site scripting (XSS) attacks via the addto parameter to fup.
- Record
CVE-2014-3877- Updated
- 2026-11-02
OSVDEBIAN-CVE-2014-3877 No score
Incomplete blacklist vulnerability in Frams' Fast File EXchange (F*EX, aka fex) before fex-20140530 allows remote attackers to conduct cross-site scripting (XSS) attacks via the addto parameter to fup.
- Record
DEBIAN-CVE-2014-3877- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
fexDebian:12 |
before 20140530-1, plus listed versions 20110601-120110608-120110608-220110610-120110610-2 Show 24 moreShow less20110620-120110622-120110726-120110726-1~bpo60+120111129-120111129-220120215-120120215-220120215-320120215-3~bpo60+120120718-120120718-220120718-320120718-420120718-520120930-120121027-120121107-120121107-1~bpo60+120130217-120130510-120130805-120140226-120140313-1 |
20140530-1 |
fexDebian:13 |
before 20140530-1, plus listed versions 20110601-120110608-120110608-220110610-120110610-2 Show 24 moreShow less20110620-120110622-120110726-120110726-1~bpo60+120111129-120111129-220120215-120120215-220120215-320120215-3~bpo60+120120718-120120718-220120718-320120718-420120718-520120930-120121027-120121107-120121107-1~bpo60+120130217-120130510-120130805-120140226-120140313-1 |
20140530-1 |
fexDebian:6.0 From an advisory covering 3 CVEs |
before 20100208+debian1-1+squeeze4 | 20100208+debian1-1+squeeze4 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2014-3877 is a medium vulnerability (CVSS 4.3) in Ulli Horlacher Fex, published June 18, 2014. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.91%, the 79th percentile. Fixed in fex 20140530-1.
References
packetstormsecurity.com/files/126906/F-EX-20140313-1-HTTP-Response-Splitting-Cross-Site-Scripting.html
fex.rus.uni-stuttgart.de/fex.html
lsexperts.de/advisories/lse-2014-05-22.txt
nvd.nist.gov/vuln/detail/CVE-2014-3877
github.com/advisories/GHSA-8g57-j3c3-fvfv
security-tracker.debian.org/tracker/CVE-2014-3877