PT-2012-4196 · Drupal · Smart Breadcrumb

Published 2012-06-27 · Updated 2017-08-29 · CVE-2012-2705

Positive Technologies (AI Summary)

CVSS v2.0

2.1

Low

Base vector

AV:N/AC:H/Au:S/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions Smart Breadcrumb module versions 6.x-1.x before 6.x-1.3

Description The issue concerns the filter titles function, which does not properly convert a title to plain-text. This allows remote authenticated users with create or edit node permissions to conduct cross-site scripting (XSS) attacks via the title parameter.

Recommendations For Smart Breadcrumb module versions 6.x-1.x before 6.x-1.3, update to version 6.x-1.3 or later to resolve the issue. As a temporary workaround, consider restricting access to the filter titles function or limiting the ability to create or edit nodes to trusted users until the update can be applied.

Fix

RCE

Weakness Enumeration

CWE-20

Related Identifiers

CVE-2012-2705

Affected Products

Smart Breadcrumb

References · 9

• http://drupal.org/node/1585564 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2012-2705 · Security Note
• http://drupalcode.org/project/smart_breadcrumb.git/commitdiff/834f75a · Patch
• http://secunia.com/advisories/49163 · Vendor Advisory
• http://drupal.org/node/1568216 · Patch
• http://openwall.com/lists/oss-security/2012/06/14/3 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/75713 · Note
• http://osvdb.org/82006 · Note
• http://securityfocus.com/bid/53592 · Note