PT-2015-7336 · Drupal · Search Api Autocomplete Module

Published 2015-08-31 · Updated 2015-09-01 · CVE-2015-6752

Positive Technologies (AI Summary)

CVSS v2.0

2.1

Low

Base vector

AV:N/AC:H/Au:S/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions Drupal Search API Autocomplete module versions 7.x-1.x before 7.x-1.3

Description A cross-site scripting (XSS) issue exists in the Search API Autocomplete module for Drupal. This occurs when the search index is configured to use the HTML filter processor, allowing remote authenticated users with certain permissions to inject arbitrary web script or HTML via unspecified vectors. The returned suggestions do not properly handle these injections.

Recommendations For versions prior to 7.x-1.3, update to version 7.x-1.3 or later to resolve the issue.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2015-6752

Affected Products

Search Api Autocomplete Module

References · 3

• https://drupal.org/node/2553485 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2015-6752 · Security Note
• https://drupal.org/node/2553977 · Vendor Advisory