VULNERABILITY INTELLIGENCE

CVE-2014-8114

CVSS score6.8 MEDIUM
EPSS probability3.10%
CISA KEVNot currently listed
Published2015-02-20
Last modified2026-06-17
CVSS vectorAV:N/AC:M/Au:N/C:P/I:P/A:P

Description

The UberFire Framework 0.3.x does not properly restrict paths, which allows remote attackers to (1) execute arbitrary code by uploading crafted content to FileUploadServlet or (2) read arbitrary files via vectors involving FileDownloadServlet.

Primary references