{"id":"CVE-2014-5326","aliases":["EUVD-2022-4898","GHSA-q5v2-2v66-6hwm","SUSE-SU-2018:1743-1","SUSE-SU-2018:1745-1","SUSE-SU-2018:1751-1"],"status":"published","title":"Improper Neutralization of Input During Web Page Generation in Direct Web Remoting","description":"Cross-site scripting (XSS) vulnerability in Direct Web Remoting (DWR) through 2.0.10 and 3.x through 3.0.RC2 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.","severity":{"version":"2.0","score":4.3,"vector":"AV:N/AC:M/Au:N/C:N/I:P/A:N","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-07","score":0.01148,"percentile":0.66994,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-79"],"published":"2014-11-24T02:00:00Z","modified":"2026-06-17T00:11:22Z","fixes":[{"ecosystem":"Maven","package":"org.directwebremoting:dwr","fixed_in":["2.0.11","3.0.RC3"],"sources":["ghsa","osv"]},{"ecosystem":"SUSE:Manager Server 3.1","package":"dwr","fixed_in":["3.0rc2+svn4059-0.12.3.10"],"sources":["osv"]},{"ecosystem":"SUSE:Manager Server 3.0","package":"dwr","fixed_in":["3.0rc2+svn4059-0.12.3.1"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"Maven","package":"org.directwebremoting:dwr","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.11"}]}]},{"source":"ghsa","ecosystem":"Maven","package":"org.directwebremoting:dwr","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.0.M1"},{"last_affected":"3.0.RC2"},{"fixed":"3.0.RC3"}]}]},{"source":"osv","ecosystem":"Maven","package":"org.directwebremoting:dwr","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.11"}]}],"versions":["2.0.1","2.0.10","2.0.2","2.0.3","2.0.8","2.0.9","2.0.rc1","2.0.rc2"]},{"source":"osv","ecosystem":"Maven","package":"org.directwebremoting:dwr","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.0.M1"},{"fixed":"3.0.RC3"}]}],"versions":["3.0.M1"]},{"source":"osv","ecosystem":"SUSE:Manager Server 3.1","package":"dwr","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0rc2+svn4059-0.12.3.10"}]}]},{"source":"osv","ecosystem":"SUSE:Manager Server 3.0","package":"dwr","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0rc2+svn4059-0.12.3.1"}]}]},{"source":"osv","ecosystem":"SUSE:Manager Server 3.1","package":"cobbler","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.6.6-5.10.4"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Manager Server 3.1","package":"google-gson","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.8.2-3.3.6"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Manager Server 3.1","package":"patterns-suse-manager","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1-3.3.2"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Manager Server 3.1","package":"prometheus-client-java","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.3.0-1.3.5"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Manager Server 3.1","package":"py26-compat-salt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2016.11.4-1.7.2"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Manager Server 3.1","package":"salt-netapi-client","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.14.0-3.9.5"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Manager Server 3.1","package":"spacewalk-backend","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.7.73.13-2.19.5"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Manager Server 3.1","package":"spacewalk-branding","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.7.2.13-2.19.5"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Manager Server 3.1","package":"spacewalk-certs-tools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.7.0.10-2.12.4"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Manager Server 3.1","package":"spacewalk-java","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.7.46.14-2.25.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Manager Server 3.1","package":"spacewalk-utils","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.7.10.7-2.10.4"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Manager Server 3.1","package":"spacewalk-web","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.7.1.16-2.19.5"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Manager Server 3.1","package":"susemanager","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.14-2.19.5"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Manager Server 3.1","package":"susemanager-docs_en","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1-10.20.7"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Manager Server 3.1","package":"susemanager-frontend-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.1-3.3.2"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Manager Server 3.1","package":"susemanager-schema","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.17-2.23.3"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Manager Server 3.1","package":"susemanager-sls","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.17-2.23.2"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Manager Server 3.1","package":"susemanager-sync-data","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.14-2.23.2"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Manager Server 3.1","package":"susemanager-tftpsync","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.3-3.6.2"}]}],"bundled":2}],"products":[{"vendor":"directwebremoting","product":"direct_web_remoting"}],"references":[{"url":"http://jvn.jp/en/jp/JVN52422792/index.html","tags":["third-party-advisory","x_refsource_JVN","x_transferred","web"]},{"url":"http://jvndb.jvn.jp/jvndb/JVNDB-2014-000118","tags":["third-party-advisory","x_refsource_JVNDB","x_transferred","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2014-5326","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-q5v2-2v66-6hwm"},{"url":"https://www.suse.com/support/update/announcement/2018/suse-su-20181743-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1085650","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2014-5326","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2018/suse-su-20181745-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2018/suse-su-20181751-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1073267","tags":["report"]},{"url":"https://bugzilla.suse.com/1074594","tags":["report"]},{"url":"https://bugzilla.suse.com/1075466","tags":["report"]},{"url":"https://bugzilla.suse.com/1080474","tags":["report"]},{"url":"https://bugzilla.suse.com/1081714","tags":["report"]},{"url":"https://bugzilla.suse.com/1082796","tags":["report"]},{"url":"https://bugzilla.suse.com/1083278","tags":["report"]},{"url":"https://bugzilla.suse.com/1083513","tags":["report"]},{"url":"https://bugzilla.suse.com/1084679","tags":["report"]},{"url":"https://bugzilla.suse.com/1085044","tags":["report"]},{"url":"https://bugzilla.suse.com/1085471","tags":["report"]},{"url":"https://bugzilla.suse.com/1085838","tags":["report"]},{"url":"https://bugzilla.suse.com/1087055","tags":["report"]},{"url":"https://bugzilla.suse.com/1087071","tags":["report"]},{"url":"https://bugzilla.suse.com/1087840","tags":["report"]},{"url":"https://bugzilla.suse.com/1088667","tags":["report"]},{"url":"https://bugzilla.suse.com/1088861","tags":["report"]},{"url":"https://bugzilla.suse.com/1089103","tags":["report"]},{"url":"https://bugzilla.suse.com/1089396","tags":["report"]},{"url":"https://bugzilla.suse.com/1089401","tags":["report"]},{"url":"https://bugzilla.suse.com/1089468","tags":["report"]},{"url":"https://bugzilla.suse.com/1090040","tags":["report"]},{"url":"https://bugzilla.suse.com/1090059","tags":["report"]},{"url":"https://bugzilla.suse.com/1090205","tags":["report"]},{"url":"https://bugzilla.suse.com/1090221","tags":["report"]},{"url":"https://bugzilla.suse.com/1090395","tags":["report"]},{"url":"https://bugzilla.suse.com/1090400","tags":["report"]},{"url":"https://bugzilla.suse.com/1090401","tags":["report"]},{"url":"https://bugzilla.suse.com/1090585","tags":["report"]},{"url":"https://bugzilla.suse.com/1091052","tags":["report"]},{"url":"https://bugzilla.suse.com/1091091","tags":["report"]},{"url":"https://bugzilla.suse.com/1091667","tags":["report"]},{"url":"https://bugzilla.suse.com/1091840","tags":["report"]},{"url":"https://bugzilla.suse.com/1091855","tags":["report"]},{"url":"https://bugzilla.suse.com/1092161","tags":["report"]},{"url":"https://bugzilla.suse.com/1092194","tags":["report"]},{"url":"https://bugzilla.suse.com/1092275","tags":["report"]},{"url":"https://bugzilla.suse.com/1092383","tags":["report"]},{"url":"https://bugzilla.suse.com/1092492","tags":["report"]},{"url":"https://bugzilla.suse.com/1095231","tags":["report"]},{"url":"https://bugzilla.suse.com/1095569","tags":["report"]},{"url":"https://bugzilla.suse.com/1096714","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2017-1000469","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2014-5326","description":"Cross-site scripting (XSS) vulnerability in Direct Web Remoting (DWR) through 2.0.10 and 3.x through 3.0.RC2 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.","status":"published","published":"2014-11-24T02:00:00Z","modified":"2024-08-06T11:41:48.653Z","updated_at":"2026-11-02T14:33:41.889751Z"}],"euvd":[{"id":"EUVD-2022-4898","description":"Cross-site scripting (XSS) vulnerability in Direct Web Remoting (DWR) through 2.0.10 and 3.x through 3.0.RC2 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.","status":"published","published":"2014-11-24T02:00:00Z","modified":"2024-08-06T11:41:48Z","updated_at":"2026-11-03T01:57:03.276706Z"}],"ghsa":[{"id":"GHSA-q5v2-2v66-6hwm","title":"Improper Neutralization of Input During Web Page Generation in Direct Web Remoting","description":"Cross-site scripting (XSS) vulnerability in Direct Web Remoting (DWR) through 2.0.10 and 3.x through 3.0.RC2 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.","status":"published","published":"2022-05-17T04:21:06Z","modified":"2023-01-27T05:02:36Z","cwes":["CWE-79"],"updated_at":"2026-11-02T14:36:19.144959Z"}],"nvd":[{"id":"CVE-2014-5326","description":"Cross-site scripting (XSS) vulnerability in Direct Web Remoting (DWR) through 2.0.10 and 3.x through 3.0.RC2 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.","status":"published","published":"2014-11-24T02:59:03.16Z","modified":"2026-06-17T00:11:22.76Z","cvss":[{"version":"2.0","score":4.3,"vector":"AV:N/AC:M/Au:N/C:N/I:P/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:02:57.304171Z"}],"osv":[{"id":"GHSA-q5v2-2v66-6hwm","title":"Improper Neutralization of Input During Web Page Generation in Direct Web Remoting","description":"Cross-site scripting (XSS) vulnerability in Direct Web Remoting (DWR) through 2.0.10 and 3.x through 3.0.RC2 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.","status":"published","published":"2022-05-17T04:21:06Z","modified":"2024-12-07T05:38:42.459059Z","cwes":["CWE-79"],"updated_at":"2026-11-02T15:46:54.055966Z"},{"id":"SUSE-SU-2018:1743-1","title":"Security update for dwr","description":"This update for dwr fixes the following issues:\n\nSecurity issue fixed:\n\n- CVE-2014-5326: Fix cross-site scripting (XSS) vulnerability (bsc#1085650).\n","status":"published","published":"2018-06-19T13:46:41Z","modified":"2026-02-04T03:11:11.006233Z","updated_at":"2026-11-02T15:53:44.972817Z"},{"id":"SUSE-SU-2018:1745-1","title":"Security update for dwr","description":"This update for dwr fixes the following issues:\n\nSecurity issue fixed:\n\n- CVE-2014-5326: Fix cross-site scripting (XSS) vulnerability (bsc#1085650).\n","status":"published","published":"2018-06-19T13:46:13Z","modified":"2026-02-04T03:10:31.215811Z","updated_at":"2026-11-02T15:53:44.972817Z"},{"id":"SUSE-SU-2018:1751-1","title":"Security update for SUSE Manager Server 3.1","description":"\nThis update provides the following fixes and improvements for SUSE Manager Server 3.1:\n\nThe following new package has been added:\n\npy26-compat-salt:\n\nThis package provides compatibility with Python 2.6 for salt.\n\nThis update includes the following new features:\n\n  (fate#325476)\n\nAdditonally, the following issues have been fixed:\n\ncobbler:\n\n- Detect if there is already another instance of 'cobbler sync'\n  running and exit with failure if so. (bsc#1081714)\n- CVE-2017-1000469: Escape shell parameters provided by the user \n  for the reposync action. (bsc#1074594)\n- Add sles15 distro profile. (bsc#1090205)\n\ngoogle-gson:\n\n- Update to version 2.8.2. (bsc#1091091)\n\npatterns-suse-manager:\n\n- Require py26-compat-salt and python3-salt to be able to connect with\n  salt-ssh to a system which has python2.6 or python3 installed. (fate#325476)\n\nsalt-netapi-client:\n\n- See https://github.com/SUSE/salt-netapi-client/releases/tag/v0.14.0\n\nspacewalk-backend:\n\n- Do not fail boostrap if no ip6addr interface. (bsc#1090395)\n- Allow again to use a higher version of spacewalk-backend-libs\n  with spacewalk-backend. (bsc#1092383)\n- SLE15 support: recommended/required flag for products and channels.\n\nspacewalk-branding:\n\n- Fix URL for new products page. (bsc#1092492)\n- SLE15 support: recommended/required flag for products and channels.\n- Show channel label when listing config channels. (bsc#1083278)\n\nspacewalk-certs-tools:\n\n- Fix bootstrap script for python3. (bsc#1091840)\n- Support SLE15 product family.\n\nspacewalk-java:\n\n- Do not create new product if product_id exists, update it instead (bsc#1096714)\n- Fix deletion of Taskomatic schedules via the GUI (bsc#1095569)\n- Fix unknown installed products when using salt-ssh. (bsc#1088861)\n- Prevent NPE when no image build history details are available. (bsc#1092161)\n- Uniform the notification message when scheduling HW refresh. (bsc#1082796)\n- Add SLES12 SP2 LTSS family. (bsc#1092194)\n- Fix token cleanup task crashing. (bsc#1090585)\n- HW refresh fails on SLE15 Salt client. (bsc#1090221)\n- Only show the most relevant (least effort) solutions. (bsc#1087071)\n- Add support for autoinstallation of SLE15. (bsc#1090205)\n- Update sles_register cobbler snippets to work with SLE15. (bsc#1090205)\n- Support SLE15 product family.\n- Show channel label when listing config channels. (bsc#1083278)\n- Fix equals to display channels with same name but different label. (bsc#1083278)\n- Avoid init.sls files with no revision on Config State Channels. (bsc#1091855)\n- Fix taskomatic deadlock in failure case. (bsc#1085471)\n- Render configuration files with UTF-8. (bsc#1088667)\n- Update google-gson to version 2.8.2. (bsc#1091091)\n- Fix updating Subscription cache. (bsc#1075466)\n- Fix NPE in websocket session configurator. (bsc#1080474)\n- Wait until minion is back to set RebootAction as COMPLETED. (bsc#1089401)\n- Add support for Prometheus monitoring.\n- Fix constraint violation errors when onboarding. (bsc#1089468)\n- Fix Advanced search for systems with installed packages. (bsc#1085838)\n\nspacewalk-utils:\n\n- Clone-by-date removes packages only if the list is not empty. (bsc#1089396)\n\nspacewalk-web:\n\n- Fix misleading message when syncing channels. (bsc#1089103)\n- Automatically select mandatory channels when selecting a base channel. (bsc#1083513)\n- Fix ace.js editor config to use soft tabs. (bsc#1090040)\n- Display always config channel name and label. (bsc#1083278)\n\nsusemanager:\n\n- Add missing python3 packages to bootstrap JeOS image. (bsc#1085044)\n- Support SLE15 product family.\n- Fix crash on not properly configured environment. (bsc#1092275)\n- Provide full traditional stack in RES bootstrap repo. (bsc#1091667)\n- Fix bootstrap script for python3. (bsc#1091840)\n- Fix unknown installed products when using salt-ssh. (bsc#1088861)\n- Add python2-salt to RES7 and SLES12 bootstrap repository.\n- Fix bootstrapping RHEL 7 salt client (missing python-ipaddress). (bsc#1087055)\n\nsusemanager-frontend-libs:\n\n- Enforce susemanager-nodejs-sdk-devel dependency version. (bsc#1095231)\n\nsusemanager-docs_en:\n\n- Documentation: mgr-create-bootstrap-repo documented flag is not correct. (bsc#1090400)\n- Remove LTSS from SUSE Linux Enterprise 11 SP4 in gs. (bsc#1090401)\n- Configuration Macros do not work. (bsc#1084679)\n- Updated spacecmd with new functions.\n- Update bootstrap warning for sles 15 clients and python 3 - in reference and gs.\n\nsusemanager-schema:\n\n- Add SLE15 distribution. (bsc#1090205)\n- SLE15 support: recommended/required flag for products and channels.\n- Support SLE15 product family.\n- Fix a race condition on lookup_evr. (bsc#1090059)\n\nsusemanager-sls:\n\n- Install python2/3 salt flavours on buildhosts to generate a compatible\n  thin for the dockerimage beeing build. (bsc#1092161)\n- Docker.login requires a list as input. (bsc#1092161)\n- Fix profileupdate sls to execute retrieval of kernel live patching info. (bsc#1091052)\n- Support SLE15 product family.\n- Fix hardware refresh when FQDN changes. (bsc#1073267)\n- Create bootstrap repo only if it exist in the server. (bsc#1087840)\n- Fix master tops merging when running salt\u003e=2018.\n- Use dockermod with new salt and user repository/tag option for build.\n\nsusemanager-sync-data:\n\n- Set SLE15 channel update tags to final version.\n- Add SLES12 SP2 LTSS family. (bsc#1092194)\n- Add SLES12-SP2-LTSS product classes. (bsc#1092194)\n- Add debuginfo channels for SLE15 products.\n- Add PackageHub 15 Products.\n- Add product sle-module-live-patching 15.\n- Add new HPC 15 Product.\n- Add missing channel to sle-module-basesystem 15.\n- Support SLE15 product family.\n\nsusemanager-tftpsync:\n\n- Detect if there is already another instance of 'cobbler sync'\n  running and exit with failure if so. (bsc#1081714)\n","status":"published","published":"2018-06-19T13:47:15Z","modified":"2026-02-04T02:20:54.356081Z","updated_at":"2026-11-02T15:53:44.972817Z"}]}}