PT-2015-6528 · Drupal · Drupal Sms Framework

Pere Orga · Published 2015-06-15 · Updated 2015-06-30 · CVE-2015-4346

Positive Technologies (AI Summary)

CVSS v2.0

2.6

Low

Base vector

AV:N/AC:H/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions Drupal SMS Framework module versions 6.x-1.x before 6.x-1.1

Description A cross-site scripting (XSS) issue exists in the SMS Framework module for Drupal. This occurs when the "Send to phone" submodule is enabled, allowing remote attackers to inject arbitrary web script or HTML via unspecified vectors related to message previews.

Recommendations For Drupal SMS Framework module versions 6.x-1.x before 6.x-1.1, update to version 6.x-1.1 or later to resolve the issue. As a temporary workaround, consider disabling the "Send to phone" submodule until a patch is applied.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2015-4346

Affected Products

Drupal Sms Framework

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2015-4346 · Security Note
• https://drupal.org/node/2431717 · Patch
• https://drupal.org/node/2437943 · Vendor Advisory
• http://securityfocus.com/bid/72807 · Note
• http://openwall.com/lists/oss-security/2015/04/25/6 · Note