PT-2019-6670 · Drupal · Drupal Views Bulk Operations

Jan Lieskovsky · Publicado 2019-11-25 · Atualizado 2019-12-12 · CVE-2011-3373

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Média

Vetor base

AV:N/AC:M/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions Drupal Views Bulk Operations (VBO) module versions 6.x-1.0 through 6.x-1.10

Description The issue arises from the improper escaping of vocabulary help in the Drupal Views Bulk Operations (VBO) module when user tagging is enabled and the "Modify node taxonomy terms" action is used. This could allow a remote attacker to provide a specially-crafted URL, potentially leading to a cross-site scripting (XSS) attack.

Recommendations For versions 6.x-1.0 through 6.x-1.10, consider disabling the "Modify node taxonomy terms" action until a proper fix is available to prevent potential XSS attacks. Restrict access to user tagging functionality in the vocabulary to minimize the risk of exploitation. Avoid using the vulnerable module for critical operations until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

CVE-2011-3373

Produtos afetados

Drupal Views Bulk Operations

Referências · 6

• https://access.redhat.com/security/cve/cve-2011-3373 · Nota
• https://t.me/cibsecurity/8312 · Publicação no Telegram
• https://securityfocus.com/bid/49727 · Nota
• https://openwall.com/lists/oss-security/2011/09/22/4 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2011-3373 · Nota de Segurança
• https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2011-3373 · Nota