Lucene search

[email protected]CVE-2012-5551

HistoryDec 03, 2012 - 9:55 p.m.

CVE-2012-5551

2012-12-0321:55:02

CWE-79

[email protected]

web.nvd.nist.gov

cve-2012-5551

mailchimp

module

drupal

xss

vulnerabilities

nvd

cve

4.3 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:N/C:N/I:P/A:N

5.8 Medium

AI Score

Confidence

High

0.002 Low

EPSS

Percentile

60.4%

JSON

Multiple cross-site scripting (XSS) vulnerabilities in the MailChimp module 7.x-2.x before 7.x-2.7 for Drupal allow remote attackers to inject arbitrary web script or HTML via vectors related to (1) a predictable “webhook URL key” and (2) improper sanitization of “Webhook variables from POST requests.”

Affected configurations

NVD

Node

thinkshoutmailchimpMatch7.x-2.0

thinkshoutmailchimpMatch7.x-2.0alpha1

thinkshoutmailchimpMatch7.x-2.0beta1

thinkshoutmailchimpMatch7.x-2.0beta2

thinkshoutmailchimpMatch7.x-2.0rc1

thinkshoutmailchimpMatch7.x-2.0rc2

thinkshoutmailchimpMatch7.x-2.1

thinkshoutmailchimpMatch7.x-2.2

thinkshoutmailchimpMatch7.x-2.3

thinkshoutmailchimpMatch7.x-2.4

thinkshoutmailchimpMatch7.x-2.5

thinkshoutmailchimpMatch7.x-2.6

thinkshoutmailchimpMatch7.x-2.xdev

AND

drupaldrupalMatch-

CPENameOperatorVersion
thinkshout:mailchimpthinkshout mailchimpeq7.x-2.0
thinkshout:mailchimpthinkshout mailchimpeq7.x-2.1
thinkshout:mailchimpthinkshout mailchimpeq7.x-2.2
thinkshout:mailchimpthinkshout mailchimpeq7.x-2.3
thinkshout:mailchimpthinkshout mailchimpeq7.x-2.4
thinkshout:mailchimpthinkshout mailchimpeq7.x-2.5
thinkshout:mailchimpthinkshout mailchimpeq7.x-2.6
thinkshout:mailchimpthinkshout mailchimpeq7.x-2.x

CPE	Name	Operator	Version
thinkshout:mailchimp	thinkshout mailchimp	eq	7.x-2.0
thinkshout:mailchimp	thinkshout mailchimp	eq	7.x-2.1
thinkshout:mailchimp	thinkshout mailchimp	eq	7.x-2.2
thinkshout:mailchimp	thinkshout mailchimp	eq	7.x-2.3
thinkshout:mailchimp	thinkshout mailchimp	eq	7.x-2.4
thinkshout:mailchimp	thinkshout mailchimp	eq	7.x-2.5
thinkshout:mailchimp	thinkshout mailchimp	eq	7.x-2.6
thinkshout:mailchimp	thinkshout mailchimp	eq	7.x-2.x

References

drupal.org/node/1821330

drupal.org/node/1822166

www.openwall.com/lists/oss-security/2012/11/20/4

www.securityfocus.com/bid/56234

4.3 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:N/C:N/I:P/A:N

5.8 Medium

AI Score

Confidence

High

0.002 Low

EPSS

Percentile

60.4%

JSON

Related for CVE-2012-5551

drupal1 nvd1 prion1 cvelist1