PT-2014-5613 · Drupal · Addressfield Tokens

Publicado 2014-06-02 · Atualizado 2015-09-02 · CVE-2014-3933

Positive Technologies (AI Summary)

CVSS v2.0

3.5

Baixa

Vetor base

AV:N/AC:M/Au:S/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions AddressField Tokens module versions 7.x-1.x before 7.x-1.4

Description The issue is related to a cross-site scripting (XSS) vulnerability in the address components field formatter. This allows remote authenticated users to inject arbitrary web script or HTML via an address field.

Recommendations For AddressField Tokens module versions 7.x-1.x before 7.x-1.4, update to version 7.x-1.4 or later to resolve the issue.

Correção

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

CVE-2014-3933

Produtos afetados

Addressfield Tokens

Referências · 5

• https://drupal.org/node/2267485 · Aviso do Fabricante
• http://securityfocus.com/bid/67545 · Nota
• https://drupal.org/node/2267475 · Correção
• http://secunia.com/advisories/58399 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2014-3933 · Nota de Segurança