PT-2015-5356 · Drupal · Gd Infinite Scroll

Published 2015-02-09 · Updated 2017-09-08 · CVE-2015-1567

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Medium

Base vector

AV:N/AC:M/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions GD Infinite Scroll module versions prior to 7.x-1.4

Description The issue is related to a cross-site scripting (XSS) vulnerability in the admin page of the GD Infinite Scroll module for Drupal. This vulnerability allows remote authenticated users with the "edit gd infinite scroll settings" permission to inject arbitrary web script or HTML.

Recommendations For versions prior to 7.x-1.4, update to version 7.x-1.4 or later to resolve the issue.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2015-1567

Affected Products

Gd Infinite Scroll

References · 4

• https://drupal.org/node/2415885 · Vendor Advisory
• https://drupal.org/node/2415219 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2015-1567 · Security Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/100629 · Note