PT-2013-5475 · Drupal · Scald

Klaus Purer · Publicado 2013-08-19 · Atualizado 2017-08-29 · CVE-2013-5315

Positive Technologies (AI Summary)

CVSS v2.0

2.6

Baixa

Vetor base

AV:N/AC:H/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions Scald module versions 6.x-1.x before 6.x-1.0-beta3 Scald module versions 7.x-1.x before 7.x-1.1

Description A cross-site scripting (XSS) issue exists in the Resource Manager of the MEE submodule in the Scald module for Drupal, allowing remote attackers to inject arbitrary web script or HTML via the atom title.

Recommendations For Scald module version 6.x-1.x, update to version 6.x-1.0-beta3 or later. For Scald module version 7.x-1.x, update to version 7.x-1.1 or later.

Exploit

Correção

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

CVE-2013-5315

Produtos afetados

Scald

Referências · 10

• 🔥 http://drupalcode.org/project/scald.git/commitdiff/32db1ee · Exploit
• 🔥 http://drupalcode.org/project/scald.git/blobdiff/9ce68f67a25200afa5256f567ef89bc4b9fd705e..974a5e29f502a58e6a955d69a85bb5f16c1c8b3e:/mee/mee.module · Exploit
• http://seclists.org/fulldisclosure/2013/Jul/224 · Nota
• http://osvdb.org/95625 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2013-5315 · Nota de Segurança
• http://securityfocus.com/bid/61426 · Nota
• https://drupal.org/node/2049415 · Aviso do Fabricante
• http://secunia.com/advisories/54144 · Aviso do Fabricante
• https://exchange.xforce.ibmcloud.com/vulnerabilities/85964 · Nota
• https://drupal.org/node/2049239 · Correção