4.3 Medium
CVSS2
Attack Vector
NETWORK
Attack Complexity
MEDIUM
Authentication
NONE
Confidentiality Impact
NONE
Integrity Impact
PARTIAL
Availability Impact
NONE
AV:N/AC:M/Au:N/C:N/I:P/A:N
0.967 High
EPSS
Percentile
99.7%
The Amadou theme outputs additional first and last classes to the list of links to help out themers. This was being done in a way that was not secure.
A Cross Site Scripting (XSS) vulnerability was identified in Amadou theme’s themes_links() function in the template.php file, which was fixed in the theme_links() function in Drupal 6.3 as noted in (SA-2008-044 <http://drupal.org/node/280571>).
CVE: CVE-2012-2715
Drupal core is not affected. If you do not use the contributed Amadou theme, there is nothing you need to do.
Install the latest version:
If you have created a custom theme with Amadou or are using Amadou as a base theme, please see below for a manual fix:
The offending code on line 77 in the original template.php file:
$output .= '<span>';
Should be replaced with the following code:
$output .= '<li> $class)) .'>';
Also see the Amadou project page.