PT-2012-5010 · Drupal · Organic Groups+1

Publicado 2012-06-27 · Atualizado 2017-08-29 · CVE-2012-3800

Positive Technologies (AI Summary)

CVSS v2.0

2.1

Baixa

Vetor base

AV:N/AC:H/Au:S/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions Organic Groups (OG) module versions 6.x-2.x before 6.x-2.4

Description The issue is related to a cross-site scripting (XSS) vulnerability. It affects the og.js file in the Organic Groups (OG) module for Drupal when used in conjunction with the Vertical Tabs module. This vulnerability allows remote authenticated users to inject arbitrary web script or HTML, specifically through vectors related to the group title.

Recommendations For Organic Groups (OG) module versions 6.x-2.x before 6.x-2.4, update to version 6.x-2.4 or later to resolve the issue.

Exploit

Correção

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

CVE-2012-3800

Produtos afetados

Organic Groups

Vertical Tabs

Referências · 9

• 🔥 http://drupalcode.org/project/og.git/commitdiff/d48fef5 · Exploit
• http://osvdb.org/82712 · Nota
• http://securityfocus.com/bid/53838 · Nota
• http://openwall.com/lists/oss-security/2012/06/14/3 · Nota
• https://exchange.xforce.ibmcloud.com/vulnerabilities/76149 · Nota
• http://drupal.org/node/1619736 · Correção
• http://secunia.com/advisories/49397 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2012-3800 · Nota de Segurança
• http://drupal.org/node/1619810 · Aviso do Fabricante