PT-2015-4374 · Drupal · Rules Link Module

Publicado 2015-07-06 · Atualizado 2015-07-08 · CVE-2014-9740

Positive Technologies (AI Summary)

CVSS v2.0

2.1

Baixa

Vetor base

AV:N/AC:H/Au:S/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions Rules Link module versions 7.x-1.x before 7.x-1.1

Description The issue allows remote authenticated users with the "administer rules links" permission to inject arbitrary web script or HTML via unspecified vectors. This is due to improper handling in the question and description strings in a confirmation form for a triggering Rules link.

Recommendations For Rules Link module versions 7.x-1.x before 7.x-1.1, update to version 7.x-1.1 or later to resolve the issue. As a temporary workaround, consider restricting access to the "administer rules links" permission to minimize the risk of exploitation.

Correção

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

CVE-2014-9740

Produtos afetados

Rules Link Module

Referências · 4

• https://drupal.org/node/2328549 · Correção
• http://securityfocus.com/bid/69447 · Nota
• https://drupal.org/node/2328567 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2014-9740 · Nota de Segurança