CVE-2014-5326

Improper Neutralization of Input During Web Page Generation in Direct Web Remoting

4.3 MediumFix available

Cross-site scripting (XSS) vulnerability in Direct Web Remoting (DWR) through 2.0.10 and 3.x through 3.0.RC2 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.

Exploit likelihood

1.15%Up 0.1 points since Feb 4, 2022

What each source reports

NVD Score used 4.3

Cross-site scripting (XSS) vulnerability in Direct Web Remoting (DWR) through 2.0.10 and 3.x through 3.0.RC2 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.

Record: CVE-2014-5326
CVSS 2.0: 4.3 MediumAV:N/AC:M/Au:N/C:N/I:P/A:N
Weakness: CWE-79
Updated: 2026-11-02

CVE List No score

Cross-site scripting (XSS) vulnerability in Direct Web Remoting (DWR) through 2.0.10 and 3.x through 3.0.RC2 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.

Record: CVE-2014-5326
Updated: 2026-11-02

EUVDEUVD-2022-4898 No score

Cross-site scripting (XSS) vulnerability in Direct Web Remoting (DWR) through 2.0.10 and 3.x through 3.0.RC2 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.

Record: EUVD-2022-4898
Updated: 2026-11-03

GitHub AdvisoriesGHSA-q5v2-2v66-6hwm No score

Improper Neutralization of Input During Web Page Generation in Direct Web Remoting

Cross-site scripting (XSS) vulnerability in Direct Web Remoting (DWR) through 2.0.10 and 3.x through 3.0.RC2 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.

Record: GHSA-q5v2-2v66-6hwm
Weakness: CWE-79
Updated: 2026-11-02

OSVGHSA-q5v2-2v66-6hwm No score

Improper Neutralization of Input During Web Page Generation in Direct Web Remoting

Cross-site scripting (XSS) vulnerability in Direct Web Remoting (DWR) through 2.0.10 and 3.x through 3.0.RC2 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.

Record: GHSA-q5v2-2v66-6hwm
Weakness: CWE-79
Updated: 2026-11-02

OSVSUSE-SU-2018:1743-1 No score

Security update for dwr

This update for dwr fixes the following issues:

Security issue fixed:

CVE-2014-5326: Fix cross-site scripting (XSS) vulnerability (bsc#1085650).

Record: SUSE-SU-2018:1743-1
Updated: 2026-11-02

OSVSUSE-SU-2018:1745-1 No score

Security update for dwr

This update for dwr fixes the following issues:

Security issue fixed:

CVE-2014-5326: Fix cross-site scripting (XSS) vulnerability (bsc#1085650).

Record: SUSE-SU-2018:1745-1
Updated: 2026-11-02

OSVSUSE-SU-2018:1751-1 No score

Security update for SUSE Manager Server 3.1

This update provides the following fixes and improvements for SUSE Manager Server 3.1:

The following new package has been added:

py26-compat-salt:

This package provides compatibility with Python 2.6 for salt.

This update includes the following new features:

(fate#325476)

Additonally, the following issues have been fixed:

cobbler:

Detect if there is already another instance of 'cobbler sync' running and exit with failure if so. (bsc#1081714)
CVE-2017-1000469: Escape shell parameters provided by the user for the reposync action. (bsc#1074594)
Add sles15 distro profile. (bsc#1090205)

google-gson:

Update to version 2.8.2. (bsc#1091091)

patterns-suse-manager:

Require py26-compat-salt and python3-salt to be able to connect with salt-ssh to a system which has python2.6 or python3 installed. (fate#325476)

salt-netapi-client:

See https://github.com/SUSE/salt-netapi-client/releases/tag/v0.14.0

spacewalk-backend:

Do not fail boostrap if no ip6addr interface. (bsc#1090395)
Allow again to use a higher version of spacewalk-backend-libs with spacewalk-backend. (bsc#1092383)
SLE15 support: recommended/required flag for products and channels.

spacewalk-branding:

Fix URL for new products page. (bsc#1092492)
SLE15 support: recommended/required flag for products and channels.
Show channel label when listing config channels. (bsc#1083278)

spacewalk-certs-tools:

Fix bootstrap script for python3. (bsc#1091840)
Support SLE15 product family.

spacewalk-java:

Do not create new product if product_id exists, update it instead (bsc#1096714)
Fix deletion of Taskomatic schedules via the GUI (bsc#1095569)
Fix unknown installed products when using salt-ssh. (bsc#1088861)
Prevent NPE when no image build history details are available. (bsc#1092161)
Uniform the notification message when scheduling HW refresh. (bsc#1082796)
Add SLES12 SP2 LTSS family. (bsc#1092194)
Fix token cleanup task crashing. (bsc#1090585)
HW refresh fails on SLE15 Salt client. (bsc#1090221)
Only show the most relevant (least effort) solutions. (bsc#1087071)
Add support for autoinstallation of SLE15. (bsc#1090205)
Update sles_register cobbler snippets to work with SLE15. (bsc#1090205)
Support SLE15 product family.
Show channel label when listing config channels. (bsc#1083278)
Fix equals to display channels with same name but different label. (bsc#1083278)
Avoid init.sls files with no revision on Config State Channels. (bsc#1091855)
Fix taskomatic deadlock in failure case. (bsc#1085471)
Render configuration files with UTF-8. (bsc#1088667)
Update google-gson to version 2.8.2. (bsc#1091091)
Fix updating Subscription cache. (bsc#1075466)
Fix NPE in websocket session configurator. (bsc#1080474)
Wait until minion is back to set RebootAction as COMPLETED. (bsc#1089401)
Add support for Prometheus monitoring.
Fix constraint violation errors when onboarding. (bsc#1089468)
Fix Advanced search for systems with installed packages. (bsc#1085838)

spacewalk-utils:

Clone-by-date removes packages only if the list is not empty. (bsc#1089396)

spacewalk-web:

Fix misleading message when syncing channels. (bsc#1089103)
Automatically select mandatory channels when selecting a base channel. (bsc#1083513)
Fix ace.js editor config to use soft tabs. (bsc#1090040)
Display always config channel name and label. (bsc#1083278)

susemanager:

Add missing python3 packages to bootstrap JeOS image. (bsc#1085044)
Support SLE15 product family.
Fix crash on not properly configured environment. (bsc#1092275)
Provide full traditional stack in RES bootstrap repo. (bsc#1091667)
Fix bootstrap script for python3. (bsc#1091840)
Fix unknown installed products when using salt-ssh. (bsc#1088861)
Add python2-salt to RES7 and SLES12 bootstrap repository.
Fix bootstrapping RHEL 7 salt client (missing python-ipaddress). (bsc#1087055)

susemanager-frontend-libs:

Enforce susemanager-nodejs-sdk-devel…

Record: SUSE-SU-2018:1751-1
Updated: 2026-11-02

Affected products

directwebremoting direct web remoting

Affected packages

Affected packages
Package	Affected	Fixed
`org.directwebremoting:dwr` Maven	before 2.0.11	2.0.11
`org.directwebremoting:dwr` Maven	3.0.M1 to 3.0.RC2	3.0.RC3
`org.directwebremoting:dwr` Maven	before 2.0.11, plus listed versions 2.0.12.0.102.0.22.0.32.0.82.0.92.0.rc12.0.rc2	2.0.11
`org.directwebremoting:dwr` Maven	3.0.M1 up to 3.0.RC3	3.0.RC3
`dwr` SUSE:Manager Server 3.1	before 3.0rc2+svn4059-0.12.3.10	3.0rc2+svn4059-0.12.3.10
`dwr` SUSE:Manager Server 3.0	before 3.0rc2+svn4059-0.12.3.1	3.0rc2+svn4059-0.12.3.1
`cobbler` SUSE:Manager Server 3.1 From an advisory covering 2 CVEs	before 2.6.6-5.10.4	2.6.6-5.10.4
`google-gson` SUSE:Manager Server 3.1 From an advisory covering 2 CVEs	before 2.8.2-3.3.6	2.8.2-3.3.6
`patterns-suse-manager` SUSE:Manager Server 3.1 From an advisory covering 2 CVEs	before 3.1-3.3.2	3.1-3.3.2
`prometheus-client-java` SUSE:Manager Server 3.1 From an advisory covering 2 CVEs	before 0.3.0-1.3.5	0.3.0-1.3.5

Show 15 moreShow less

Affected packages
Package	Affected	Fixed
`py26-compat-salt` SUSE:Manager Server 3.1 From an advisory covering 2 CVEs	before 2016.11.4-1.7.2	2016.11.4-1.7.2
`salt-netapi-client` SUSE:Manager Server 3.1 From an advisory covering 2 CVEs	before 0.14.0-3.9.5	0.14.0-3.9.5
`spacewalk-backend` SUSE:Manager Server 3.1 From an advisory covering 2 CVEs	before 2.7.73.13-2.19.5	2.7.73.13-2.19.5
`spacewalk-branding` SUSE:Manager Server 3.1 From an advisory covering 2 CVEs	before 2.7.2.13-2.19.5	2.7.2.13-2.19.5
`spacewalk-certs-tools` SUSE:Manager Server 3.1 From an advisory covering 2 CVEs	before 2.7.0.10-2.12.4	2.7.0.10-2.12.4
`spacewalk-java` SUSE:Manager Server 3.1 From an advisory covering 2 CVEs	before 2.7.46.14-2.25.1	2.7.46.14-2.25.1
`spacewalk-utils` SUSE:Manager Server 3.1 From an advisory covering 2 CVEs	before 2.7.10.7-2.10.4	2.7.10.7-2.10.4
`spacewalk-web` SUSE:Manager Server 3.1 From an advisory covering 2 CVEs	before 2.7.1.16-2.19.5	2.7.1.16-2.19.5
`susemanager` SUSE:Manager Server 3.1 From an advisory covering 2 CVEs	before 3.1.14-2.19.5	3.1.14-2.19.5
`susemanager-docs_en` SUSE:Manager Server 3.1 From an advisory covering 2 CVEs	before 3.1-10.20.7	3.1-10.20.7
`susemanager-frontend-libs` SUSE:Manager Server 3.1 From an advisory covering 2 CVEs	before 3.1.1-3.3.2	3.1.1-3.3.2
`susemanager-schema` SUSE:Manager Server 3.1 From an advisory covering 2 CVEs	before 3.1.17-2.23.3	3.1.17-2.23.3
`susemanager-sls` SUSE:Manager Server 3.1 From an advisory covering 2 CVEs	before 3.1.17-2.23.2	3.1.17-2.23.2
`susemanager-sync-data` SUSE:Manager Server 3.1 From an advisory covering 2 CVEs	before 3.1.14-2.23.2	3.1.14-2.23.2
`susemanager-tftpsync` SUSE:Manager Server 3.1 From an advisory covering 2 CVEs	before 3.1.3-3.6.2	3.1.3-3.6.2

History

History
Recorded	Changed	Sources
Nov 6, 2026	affected, facts
Nov 3, 2026	aliases	EUVD
Nov 2, 2026	first indexed	CVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2014-5326 is a medium vulnerability (CVSS 4.3) in Directwebremoting Direct Web Remoting, published November 24, 2014. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.15%, the 66th percentile. Fixed in org.directwebremoting:dwr 2.0.11.

References

Show 46 moreShow less

This page doesn't list everything

Left out here: the rest of 1 source description. The JSON record has them.