PT-2013-5475 · Drupal · Scald

Klaus Purer · Published 2013-08-19 · Updated 2017-08-29 · CVE-2013-5315

Positive Technologies (AI Summary)

CVSS v2.0

2.6

Low

Base vector

AV:N/AC:H/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions Scald module versions 6.x-1.x before 6.x-1.0-beta3 Scald module versions 7.x-1.x before 7.x-1.1

Description A cross-site scripting (XSS) issue exists in the Resource Manager of the MEE submodule in the Scald module for Drupal, allowing remote attackers to inject arbitrary web script or HTML via the atom title.

Recommendations For Scald module version 6.x-1.x, update to version 6.x-1.0-beta3 or later. For Scald module version 7.x-1.x, update to version 7.x-1.1 or later.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2013-5315

Affected Products

Scald

References · 10

• 🔥 http://drupalcode.org/project/scald.git/commitdiff/32db1ee · Exploit
• 🔥 http://drupalcode.org/project/scald.git/blobdiff/9ce68f67a25200afa5256f567ef89bc4b9fd705e..974a5e29f502a58e6a955d69a85bb5f16c1c8b3e:/mee/mee.module · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2013-5315 · Security Note
• https://drupal.org/node/2049415 · Vendor Advisory
• http://secunia.com/advisories/54144 · Vendor Advisory
• https://drupal.org/node/2049239 · Patch
• http://seclists.org/fulldisclosure/2013/Jul/224 · Note
• http://osvdb.org/95625 · Note
• http://securityfocus.com/bid/61426 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/85964 · Note