PT-2013-3384 · Drupal · Creative Theme

Forest Monsen · Publicado 2013-03-27 · Atualizado 2013-03-28 · CVE-2013-1778

Positive Technologies (AI Summary)

CVSS v2.0

2.1

Baixa

Vetor base

AV:N/AC:H/Au:S/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions Creative Theme versions prior to 7.x-1.2

Description The issue is related to a cross-site scripting (XSS) vulnerability. This allows remote authenticated users with the administer themes permission to inject arbitrary web script or HTML. The vulnerability is related to vectors involving social icons.

Recommendations For versions prior to 7.x-1.2, update to version 7.x-1.2 or later to resolve the issue.

Correção

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

CVE-2013-1778

Produtos afetados

Creative Theme

Referências · 5

• http://drupal.org/node/1929474 · Aviso do Fabricante
• http://drupal.org/node/1929380 · Correção
• https://nvd.nist.gov/vuln/detail/CVE-2013-1778 · Nota de Segurança
• http://openwall.com/lists/oss-security/2013/02/28/3 · Nota
• http://drupalcode.org/project/creative.git/commitdiff/465367c · Nota