PT-2019-6670 · Drupal · Drupal Views Bulk Operations

Jan Lieskovsky · Published 2019-11-25 · Updated 2019-12-12 · CVE-2011-3373

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Medium

Base vector

AV:N/AC:M/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions Drupal Views Bulk Operations (VBO) module versions 6.x-1.0 through 6.x-1.10

Description The issue arises from the improper escaping of vocabulary help in the Drupal Views Bulk Operations (VBO) module when user tagging is enabled and the "Modify node taxonomy terms" action is used. This could allow a remote attacker to provide a specially-crafted URL, potentially leading to a cross-site scripting (XSS) attack.

Recommendations For versions 6.x-1.0 through 6.x-1.10, consider disabling the "Modify node taxonomy terms" action until a proper fix is available to prevent potential XSS attacks. Restrict access to user tagging functionality in the vocabulary to minimize the risk of exploitation. Avoid using the vulnerable module for critical operations until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2011-3373

Affected Products

Drupal Views Bulk Operations

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2011-3373 · Security Note
• https://access.redhat.com/security/cve/cve-2011-3373 · Note
• https://t.me/cibsecurity/8312 · Telegram Post
• https://securityfocus.com/bid/49727 · Note
• https://openwall.com/lists/oss-security/2011/09/22/4 · Note
• https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2011-3373 · Note