PT-2014-5613 · Drupal · Addressfield Tokens

Published 2014-06-02 · Updated 2015-09-02 · CVE-2014-3933

Positive Technologies (AI Summary)

CVSS v2.0

3.5

Low

Base vector

AV:N/AC:M/Au:S/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions AddressField Tokens module versions 7.x-1.x before 7.x-1.4

Description The issue is related to a cross-site scripting (XSS) vulnerability in the address components field formatter. This allows remote authenticated users to inject arbitrary web script or HTML via an address field.

Recommendations For AddressField Tokens module versions 7.x-1.x before 7.x-1.4, update to version 7.x-1.4 or later to resolve the issue.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2014-3933

Affected Products

Addressfield Tokens

References · 5

• https://drupal.org/node/2267485 · Vendor Advisory
• https://drupal.org/node/2267475 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2014-3933 · Security Note
• http://securityfocus.com/bid/67545 · Note
• http://secunia.com/advisories/58399 · Note