PT-2012-4353 · Drupal · Aberdeen Theme

Steven M. Christey · Publicado 2012-05-21 · Atualizado 2017-08-29 · CVE-2012-2907

Positive Technologies (AI Summary)

CVSS v2.0

2.6

Baixa

Vetor base

AV:N/AC:H/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions Aberdeen theme versions 6.x-1.x before 6.x-1.11

Description The issue is related to a cross-site scripting (XSS) vulnerability in the aberdeen breadcrumb function. This function is located in template.php in the Aberdeen theme for Drupal. When the theme is set to append the content title to the breadcrumb, remote attackers can inject arbitrary web script or HTML via the content title in a breadcrumb.

Recommendations For Aberdeen theme versions 6.x-1.x before 6.x-1.11, update to version 6.x-1.11 or later to resolve the issue. As a temporary workaround, consider disabling the appending of content titles to breadcrumbs until a patch is available. Restrict access to the aberdeen breadcrumb function in template.php to minimize the risk of exploitation.

Correção

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

CVE-2012-2907

Produtos afetados

Aberdeen Theme

Referências · 9

• http://securityfocus.com/bid/53581 · Nota
• http://openwall.com/lists/oss-security/2012/06/14/3 · Nota
• http://secunia.com/advisories/49150 · Aviso do Fabricante
• http://drupal.org/node/1585878 · Nota
• https://exchange.xforce.ibmcloud.com/vulnerabilities/75712 · Nota
• http://drupal.org/node/1585890 · Aviso do Fabricante
• http://drupalcode.org/project/aberdeen.git/commitdiff/1994e8e · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2012-2907 · Nota de Segurança
• http://openwall.com/lists/oss-security/2012/06/27/10 · Nota