CVE-2015-6752

Опубликовано: 31 авг. 2015

Источник: nvd

CVSS2: 2.1

EPSS Низкий

Описание

Cross-site scripting (XSS) vulnerability in the Search API Autocomplete module 7.x-1.x before 7.x-1.3 for Drupal, when the search index is configured to use the HTML filter processor, allows remote authenticated users with certain permissions to inject arbitrary web script or HTML via unspecified vectors, which are not properly handled in the returned suggestions.

Ссылки

https://www.drupal.org/node/2553485
Patch
https://www.drupal.org/node/2553977
Patch
Vendor Advisory
https://www.drupal.org/node/2553485
Patch
https://www.drupal.org/node/2553977
Patch
Vendor Advisory

Уязвимые конфигурации

Конфигурация 1

Одно из

cpe:2.3:a:search_api_autocomplete_project:search_api_autocomplete:7.x-1.0:*:*:*:*:drupal:*:*

cpe:2.3:a:search_api_autocomplete_project:search_api_autocomplete:7.x-1.1:*:*:*:*:drupal:*:*

cpe:2.3:a:search_api_autocomplete_project:search_api_autocomplete:7.x-1.2:*:*:*:*:drupal:*:*

EPSS

Процентиль: 34%

0.0014

Низкий

2.1 Low

CVSS2

Дефекты

CWE-79

Связанные уязвимости

GHSA-grgf-j3jj-cqpj

github

больше 3 лет назад