CVE-2014-2879

Name of the Vulnerable Software and Affected Versions Dell SonicWALL Email Security versions 7.4.5 and earlier

Description The issue allows remote authenticated administrators to inject arbitrary web script or HTML. This can be achieved via the uploadPatch parameter to the "System/Advanced" page (settings advanced.html) or the uploadLicenses parameter in the "License management" (settings upload dlicense.html) page.

Recommendations For versions 7.4.5 and earlier, consider disabling access to the settings advanced.html and settings upload dlicense.html pages until a fix is available. Restrict the use of the uploadPatch and uploadLicenses parameters to minimize the risk of exploitation.