PT-2015-6528 · Drupal · Drupal Sms Framework

Pere Orga · Publicado 2015-06-15 · Atualizado 2015-06-30 · CVE-2015-4346

Positive Technologies (AI Summary)

CVSS v2.0

2.6

Baixa

Vetor base

AV:N/AC:H/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions Drupal SMS Framework module versions 6.x-1.x before 6.x-1.1

Description A cross-site scripting (XSS) issue exists in the SMS Framework module for Drupal. This occurs when the "Send to phone" submodule is enabled, allowing remote attackers to inject arbitrary web script or HTML via unspecified vectors related to message previews.

Recommendations For Drupal SMS Framework module versions 6.x-1.x before 6.x-1.1, update to version 6.x-1.1 or later to resolve the issue. As a temporary workaround, consider disabling the "Send to phone" submodule until a patch is applied.

Correção

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

CVE-2015-4346

Produtos afetados

Drupal Sms Framework

Referências · 5

• https://nvd.nist.gov/vuln/detail/CVE-2015-4346 · Nota de Segurança
• http://securityfocus.com/bid/72807 · Nota
• https://drupal.org/node/2431717 · Correção
• http://openwall.com/lists/oss-security/2015/04/25/6 · Nota
• https://drupal.org/node/2437943 · Aviso do Fabricante