What is the CVSS score of CVE-2014-1861?

CVE-2014-1861 has a CVSS 2.0 base score of 9.3 (Critical). CVSS vector: AV:N/AC:M/Au:N/C:C/I:C/A:C. EPSS exploitation probability: 0.3%.

Jetro Cockpit Secure Browsing CVE-2014-1861

CRITICAL

Improper Input Validation (CWE-20)

2014-02-18 cve@mitre.org

Information Disclosure Jetro Cockpit Secure Browsing

9.3

CVSS 2.0 · NVD

Severity by source

NVD PRIMARY

9.3 CRITICAL

AV:N/AC:M/Au:N/C:C/I:C/A:C

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

AV:N/AC:M/Au:N/C:C/I:C/A:C

Attack Vector

Network

Attack Complexity

Confidentiality

Integrity

Availability

Lifecycle Timeline

CVE Published

Feb 18, 2014 - 11:55 cve.org

CRITICAL 9.3

DescriptionCVE.org

The client in Jetro COCKPIT Secure Browsing (JCSB) 4.3.1 and 4.3.3 does not validate the FileName element in an RDP_FILE_TRANSFER document, which allows remote JCSB servers to execute arbitrary programs by providing a .EXE extension.

AnalysisAI

Technical ContextAI

This vulnerability is classified under CWE-20. The client in Jetro COCKPIT Secure Browsing (JCSB) 4.3.1 and 4.3.3 does not validate the FileName element in an RDP_FILE_TRANSFER document, which allows remote JCSB servers to execute arbitrary programs by providing a .EXE extension. Affected products include: Jetroplatforms Jetro Cockpit Secure Browsing.

RemediationAI

No vendor patch is available at time of analysis. Monitor vendor advisories for updates. Apply vendor patches when available. Implement network segmentation and monitoring as interim mitigations.