PT-2015-7336 · Drupal · Search Api Autocomplete Module

Publicado 2015-08-31 · Atualizado 2015-09-01 · CVE-2015-6752

Positive Technologies (AI Summary)

CVSS v2.0

2.1

Baixa

Vetor base

AV:N/AC:H/Au:S/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions Drupal Search API Autocomplete module versions 7.x-1.x before 7.x-1.3

Description A cross-site scripting (XSS) issue exists in the Search API Autocomplete module for Drupal. This occurs when the search index is configured to use the HTML filter processor, allowing remote authenticated users with certain permissions to inject arbitrary web script or HTML via unspecified vectors. The returned suggestions do not properly handle these injections.

Recommendations For versions prior to 7.x-1.3, update to version 7.x-1.3 or later to resolve the issue.

Correção

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

CVE-2015-6752

Produtos afetados

Search Api Autocomplete Module

Referências · 3

• https://drupal.org/node/2553485 · Correção
• https://nvd.nist.gov/vuln/detail/CVE-2015-6752 · Nota de Segurança
• https://drupal.org/node/2553977 · Aviso do Fabricante