PT-2015-5356 · Drupal · Gd Infinite Scroll

Publicado 2015-02-09 · Atualizado 2017-09-08 · CVE-2015-1567

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Média

Vetor base

AV:N/AC:M/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions GD Infinite Scroll module versions prior to 7.x-1.4

Description The issue is related to a cross-site scripting (XSS) vulnerability in the admin page of the GD Infinite Scroll module for Drupal. This vulnerability allows remote authenticated users with the "edit gd infinite scroll settings" permission to inject arbitrary web script or HTML.

Recommendations For versions prior to 7.x-1.4, update to version 7.x-1.4 or later to resolve the issue.

Correção

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

CVE-2015-1567

Produtos afetados

Gd Infinite Scroll

Referências · 4

• https://drupal.org/node/2415885 · Aviso do Fabricante
• https://drupal.org/node/2415219 · Correção
• https://nvd.nist.gov/vuln/detail/CVE-2015-1567 · Nota de Segurança
• https://exchange.xforce.ibmcloud.com/vulnerabilities/100629 · Nota