PT-2012-4353 · Drupal · Aberdeen Theme

Steven M. Christey · Published 2012-05-21 · Updated 2017-08-29 · CVE-2012-2907

Positive Technologies (AI Summary)

CVSS v2.0

2.6

Low

Base vector

AV:N/AC:H/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions Aberdeen theme versions 6.x-1.x before 6.x-1.11

Description The issue is related to a cross-site scripting (XSS) vulnerability in the aberdeen breadcrumb function. This function is located in template.php in the Aberdeen theme for Drupal. When the theme is set to append the content title to the breadcrumb, remote attackers can inject arbitrary web script or HTML via the content title in a breadcrumb.

Recommendations For Aberdeen theme versions 6.x-1.x before 6.x-1.11, update to version 6.x-1.11 or later to resolve the issue. As a temporary workaround, consider disabling the appending of content titles to breadcrumbs until a patch is available. Restrict access to the aberdeen breadcrumb function in template.php to minimize the risk of exploitation.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2012-2907

Affected Products

Aberdeen Theme

References · 9

• http://secunia.com/advisories/49150 · Vendor Advisory
• http://drupal.org/node/1585890 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2012-2907 · Security Note
• http://securityfocus.com/bid/53581 · Note
• http://openwall.com/lists/oss-security/2012/06/14/3 · Note
• http://drupal.org/node/1585878 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/75712 · Note
• http://drupalcode.org/project/aberdeen.git/commitdiff/1994e8e · Note
• http://openwall.com/lists/oss-security/2012/06/27/10 · Note