PT-2012-4207 · Drupal · Drupal Mobile Tools Module

Kurt Seifried · Published 2012-06-27 · Updated 2017-08-29 · CVE-2012-2717

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Medium

Base vector

AV:N/AC:M/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions Drupal Mobile Tools module versions 6.x-2.x before 6.x-2.3

Description The issue allows remote attackers to inject arbitrary web script or HTML via specific fields, including the Mobile URL field, Desktop URL field to the General configuration page, or the message to the Mobile Tools block message options. This can be achieved by exploiting the Mobile Tools module.

Recommendations For versions 6.x-2.x before 6.x-2.3, update to version 6.x-2.3 or later to resolve the issue.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2012-2717

Affected Products

Drupal Mobile Tools Module

References · 10

• 🔥 http://drupalcode.org/project/mobile_tools.git/commitdiff/614b0fc · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2012-2717 · Security Note
• http://secunia.com/advisories/49318 · Vendor Advisory
• http://drupal.org/node/1169008 · Patch
• http://securityfocus.com/bid/53734 · Patch
• http://drupal.org/node/1608828 · Vendor Advisory
• http://osvdb.org/82410 · Note
• http://openwall.com/lists/oss-security/2012/06/14/3 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/76002 · Note
• http://madirish.net/content/drupal-mobile-tools-6x-23-xss · Note