PT-2012-3424 · Drupal · Drupal Webform Module

Kurt Seifried · Published 2012-09-18 · Updated 2017-08-29 · CVE-2012-1660

Positive Technologies (AI Summary)

CVSS v2.0

2.1

Low

Base vector

AV:N/AC:H/Au:S/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions Drupal Webform module versions 6.x-3.x before 6.x-3.17 Drupal Webform module versions 7.x-3.x before 7.x-3.17

Description The issue affects the Webform module in Drupal, specifically in components/select.inc, when the "Select (or other)" module is enabled. It allows remote authenticated users with the create webform content permission to inject arbitrary web script or HTML via vectors related to checkboxes or radios.

Recommendations For Drupal Webform module version 6.x-3.x before 6.x-3.17, update to version 6.x-3.17 or later. For Drupal Webform module version 7.x-3.x before 7.x-3.17, update to version 7.x-3.17 or later.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2012-1660

Affected Products

Drupal Webform Module

References · 11

• http://drupal.org/node/1472214 · Vendor Advisory
• http://drupal.org/node/1472178 · Patch
• http://secunia.com/advisories/48310 · Vendor Advisory
• http://drupal.org/node/1472180 · Patch
• http://securityfocus.com/bid/52345 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2012-1660 · Security Note
• http://osvdb.org/79852 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/73779 · Note
• http://drupalcode.org/project/webform.git/commit/90af819 · Note
• http://drupalcode.org/project/webform.git/commit/917fa91 · Note
• http://openwall.com/lists/oss-security/2012/04/07/1 · Note