PT-2012-3424 · Drupal · Drupal Webform Module

Kurt Seifried · Publicado 2012-09-18 · Atualizado 2017-08-29 · CVE-2012-1660

Positive Technologies (AI Summary)

CVSS v2.0

2.1

Baixa

Vetor base

AV:N/AC:H/Au:S/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions Drupal Webform module versions 6.x-3.x before 6.x-3.17 Drupal Webform module versions 7.x-3.x before 7.x-3.17

Description The issue affects the Webform module in Drupal, specifically in components/select.inc, when the "Select (or other)" module is enabled. It allows remote authenticated users with the create webform content permission to inject arbitrary web script or HTML via vectors related to checkboxes or radios.

Recommendations For Drupal Webform module version 6.x-3.x before 6.x-3.17, update to version 6.x-3.17 or later. For Drupal Webform module version 7.x-3.x before 7.x-3.17, update to version 7.x-3.17 or later.

Correção

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

CVE-2012-1660

Produtos afetados

Drupal Webform Module

Referências · 11

• http://osvdb.org/79852 · Nota
• https://exchange.xforce.ibmcloud.com/vulnerabilities/73779 · Nota
• http://drupal.org/node/1472214 · Aviso do Fabricante
• http://drupal.org/node/1472178 · Correção
• http://secunia.com/advisories/48310 · Aviso do Fabricante
• http://drupal.org/node/1472180 · Correção
• http://securityfocus.com/bid/52345 · Correção
• http://drupalcode.org/project/webform.git/commit/90af819 · Nota
• http://drupalcode.org/project/webform.git/commit/917fa91 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2012-1660 · Nota de Segurança
• http://openwall.com/lists/oss-security/2012/04/07/1 · Nota