PT-2013-5021 · Drupal · Simplenews

Publicado 2013-11-01 · Atualizado 2017-08-29 · CVE-2013-4447

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Média

Vetor base

AV:N/AC:M/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions Simplenews module versions 6.x-1.x before 6.x-1.5 Simplenews module versions 7.x-1.x before 7.x-1.1

Description A cross-site scripting (XSS) issue exists in the API of the Simplenews module for Drupal, allowing remote attackers to inject arbitrary web script or HTML via an email address.

Recommendations For Simplenews module versions 6.x-1.x before 6.x-1.5, update to version 6.x-1.5 or later. For Simplenews module versions 7.x-1.x before 7.x-1.1, update to version 7.x-1.1 or later.

Correção

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

CVE-2013-4447

Produtos afetados

Simplenews

Referências · 9

• http://packetstormsecurity.com/files/123660/Drupal-Simplenews-6.x-7.x-Cross-Site-Scripting.html · Nota
• https://drupal.org/node/2113487 · Correção
• https://drupal.org/node/2113491 · Correção
• http://osvdb.org/98628 · Nota
• http://seclists.org/fulldisclosure/2013/Oct/120 · Nota
• https://drupal.org/node/2113515 · Nota
• https://exchange.xforce.ibmcloud.com/vulnerabilities/88101 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2013-4447 · Nota de Segurança
• http://secunia.com/advisories/55209 · Aviso do Fabricante