Lucene search

[email protected]CVE-2014-4303

HistoryJun 18, 2014 - 2:55 p.m.

CVE-2014-4303

2014-06-1814:55:13

CWE-79

[email protected]

web.nvd.nist.gov

cve-2014-4303

cross-site scripting

xss

touch theme

drupal

administer themes permission

twitter

facebook

2.1 Low

CVSS2

Attack Vector

NETWORK

Attack Complexity

HIGH

Authentication

SINGLE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:H/Au:S/C:N/I:P/A:N

5.4 Medium

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

42.9%

JSON

Multiple cross-site scripting (XSS) vulnerabilities in the Touch theme 7.x-1.x before 7.x-1.9 for Drupal allow remote authenticated users with the Administer themes permission to inject arbitrary web script or HTML via vectors related to the (1) Twitter and (2) Facebook username settings.

Affected configurations

NVD

Node

drupactouchMatch7.x-1.0drupal

drupactouchMatch7.x-1.1drupal

drupactouchMatch7.x-1.2drupal

drupactouchMatch7.x-1.3drupal

drupactouchMatch7.x-1.4drupal

drupactouchMatch7.x-1.5drupal

drupactouchMatch7.x-1.6drupal

drupactouchMatch7.x-1.7drupal

drupactouchMatch7.x-1.8drupal

CPENameOperatorVersion
drupac:touchdrupac toucheq7.x-1.0
drupac:touchdrupac toucheq7.x-1.1
drupac:touchdrupac toucheq7.x-1.2
drupac:touchdrupac toucheq7.x-1.3
drupac:touchdrupac toucheq7.x-1.4
drupac:touchdrupac toucheq7.x-1.5
drupac:touchdrupac toucheq7.x-1.6
drupac:touchdrupac toucheq7.x-1.7
drupac:touchdrupac toucheq7.x-1.8

CPE	Name	Operator	Version
drupac:touch	drupac touch	eq	7.x-1.0
drupac:touch	drupac touch	eq	7.x-1.1
drupac:touch	drupac touch	eq	7.x-1.2
drupac:touch	drupac touch	eq	7.x-1.3
drupac:touch	drupac touch	eq	7.x-1.4
drupac:touch	drupac touch	eq	7.x-1.5
drupac:touch	drupac touch	eq	7.x-1.6
drupac:touch	drupac touch	eq	7.x-1.7
drupac:touch	drupac touch	eq	7.x-1.8

References

secunia.com/advisories/58828

www.securityfocus.com/bid/68045

drupal.org/node/2269483

drupal.org/node/2284415

2.1 Low

CVSS2

Attack Vector

NETWORK

Attack Complexity

HIGH

Authentication

SINGLE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:H/Au:S/C:N/I:P/A:N

5.4 Medium

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

42.9%

JSON

Related for CVE-2014-4303

cvelist1 nvd1 drupal1 prion1