PT-2013-3497 · Drupal · Drupal

Published 2013-06-25 · Updated 2017-08-29 · CVE-2013-1971

Positive Technologies (AI Summary)

CVSS v2.0

2.1

Low

Base vector

AV:N/AC:H/Au:S/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions Drupal versions 6.x

Description A cross-site scripting (XSS) issue exists, allowing remote authenticated users with specific permissions to inject arbitrary web script or HTML via the file name of an MP3 file in the MP3 Player module.

Recommendations For version 6.x, update the MP3 Player module to a version that includes the fix for this issue. As a temporary workaround, consider restricting access to the MP3 Player module for users with permissions that could be used to exploit this issue.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2013-1971

Affected Products

Drupal

References · 4

• https://drupal.org/node/1972804 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2013-1971 · Security Note
• http://securityfocus.com/bid/59276 · Vendor Advisory
• https://exchange.xforce.ibmcloud.com/vulnerabilities/83649 · Note