Описание
Multiple cross-site scripting (XSS) vulnerabilities in the Touch theme 7.x-1.x before 7.x-1.9 for Drupal allow remote authenticated users with the Administer themes permission to inject arbitrary web script or HTML via vectors related to the (1) Twitter and (2) Facebook username settings.
Ссылки
- Permissions RequiredThird Party Advisory
- Third Party AdvisoryVDB Entry
- PatchThird Party Advisory
- PatchThird Party Advisory
- Permissions RequiredThird Party Advisory
- Third Party AdvisoryVDB Entry
- PatchThird Party Advisory
- PatchThird Party Advisory
Уязвимые конфигурации
Конфигурация 1
Одно из
cpe:2.3:a:drupac:touch:7.x-1.0:*:*:*:*:drupal:*:*
cpe:2.3:a:drupac:touch:7.x-1.1:*:*:*:*:drupal:*:*
cpe:2.3:a:drupac:touch:7.x-1.2:*:*:*:*:drupal:*:*
cpe:2.3:a:drupac:touch:7.x-1.3:*:*:*:*:drupal:*:*
cpe:2.3:a:drupac:touch:7.x-1.4:*:*:*:*:drupal:*:*
cpe:2.3:a:drupac:touch:7.x-1.5:*:*:*:*:drupal:*:*
cpe:2.3:a:drupac:touch:7.x-1.6:*:*:*:*:drupal:*:*
cpe:2.3:a:drupac:touch:7.x-1.7:*:*:*:*:drupal:*:*
cpe:2.3:a:drupac:touch:7.x-1.8:*:*:*:*:drupal:*:*
EPSS
Процентиль: 58%
0.00366
Низкий
2.1 Low
CVSS2
Дефекты
CWE-79
Связанные уязвимости
github
больше 3 лет назад
Multiple cross-site scripting (XSS) vulnerabilities in the Touch theme 7.x-1.x before 7.x-1.9 for Drupal allow remote authenticated users with the Administer themes permission to inject arbitrary web script or HTML via vectors related to the (1) Twitter and (2) Facebook username settings.
EPSS
Процентиль: 58%
0.00366
Низкий
2.1 Low
CVSS2
Дефекты
CWE-79