PT-2015-4374 · Drupal · Rules Link Module

Published 2015-07-06 · Updated 2015-07-08 · CVE-2014-9740

Positive Technologies (AI Summary)

CVSS v2.0

2.1

Low

Base vector

AV:N/AC:H/Au:S/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions Rules Link module versions 7.x-1.x before 7.x-1.1

Description The issue allows remote authenticated users with the "administer rules links" permission to inject arbitrary web script or HTML via unspecified vectors. This is due to improper handling in the question and description strings in a confirmation form for a triggering Rules link.

Recommendations For Rules Link module versions 7.x-1.x before 7.x-1.1, update to version 7.x-1.1 or later to resolve the issue. As a temporary workaround, consider restricting access to the "administer rules links" permission to minimize the risk of exploitation.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2014-9740

Affected Products

Rules Link Module

References · 4

• https://drupal.org/node/2328549 · Patch
• https://drupal.org/node/2328567 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2014-9740 · Security Note
• http://securityfocus.com/bid/69447 · Note