PT-2010-3059 · Drupal · Drupal Own Term Module

Publicado 2010-04-13 · Atualizado 2010-04-14 · CVE-2010-1362

Positive Technologies (AI Summary)

CVSS v2.0

2.1

Baixa

Vetor base

AV:N/AC:H/Au:S/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions Drupal Own Term module version 6.x-1.0

Description A cross-site scripting (XSS) issue exists, allowing remote authenticated users with "create additional terms" privileges to inject arbitrary web script or HTML via the term description field in a term listing page.

Recommendations For version 6.x-1.0, consider disabling the term description field in the term listing page until a patch is available. Restrict access to the Own Term module to minimize the risk of exploitation. Avoid using the term description field in the affected module until the issue is resolved.

Correção

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

CVE-2010-1362

Produtos afetados

Drupal Own Term Module

Referências · 5

• https://nvd.nist.gov/vuln/detail/CVE-2010-1362 · Nota de Segurança
• http://secunia.com/advisories/38208 · Aviso do Fabricante
• http://securityfocus.com/bid/37788 · Nota
• http://drupal.org/node/683576 · Aviso do Fabricante
• http://drupal.org/node/683544 · Correção