PT-2012-4196 · Drupal · Smart Breadcrumb

Publicado 2012-06-27 · Atualizado 2017-08-29 · CVE-2012-2705

Positive Technologies (AI Summary)

CVSS v2.0

2.1

Baixa

Vetor base

AV:N/AC:H/Au:S/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions Smart Breadcrumb module versions 6.x-1.x before 6.x-1.3

Description The issue concerns the filter titles function, which does not properly convert a title to plain-text. This allows remote authenticated users with create or edit node permissions to conduct cross-site scripting (XSS) attacks via the title parameter.

Recommendations For Smart Breadcrumb module versions 6.x-1.x before 6.x-1.3, update to version 6.x-1.3 or later to resolve the issue. As a temporary workaround, consider restricting access to the filter titles function or limiting the ability to create or edit nodes to trusted users until the update can be applied.

Correção

RCE

Enumeração de Fraquezas

CWE-20

Identificadores relacionados

CVE-2012-2705

Produtos afetados

Smart Breadcrumb

Referências · 9

• http://drupal.org/node/1585564 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2012-2705 · Nota de Segurança
• http://openwall.com/lists/oss-security/2012/06/14/3 · Nota
• https://exchange.xforce.ibmcloud.com/vulnerabilities/75713 · Nota
• http://drupalcode.org/project/smart_breadcrumb.git/commitdiff/834f75a · Correção
• http://secunia.com/advisories/49163 · Aviso do Fabricante
• http://drupal.org/node/1568216 · Correção
• http://osvdb.org/82006 · Nota
• http://securityfocus.com/bid/53592 · Nota