5.8 Medium
CVSS2
Attack Vector
NETWORK
Attack Complexity
MEDIUM
Authentication
NONE
Confidentiality Impact
PARTIAL
Integrity Impact
PARTIAL
Availability Impact
NONE
AV:N/AC:M/Au:N/C:P/I:P/A:N
0.967 High
EPSS
Percentile
99.7%
Node basket module enables you to pick up nodes in a basket.
The module doesn’t sufficiently sanitize user supplied text in some pages, thereby exposing a Cross Site Scripting (XSS) vulnerability. This vulnerability is mitigated by the fact that an attacker must have a user with permission to create/edit nodes.
Also, the module has CSRF vulnerabilities. A malicious user can cause another user to add/remove nodes of the basket by getting his browser to make a request to a specially-crafted URL.
Also, the module has an Open Redirect vulnerability.
Drupal core is not affected. If you do not use the contributed Node basket module, there is nothing you need to do.
If you use the Node basket module you should uninstall it.
Also see the Node basket project page.
Not applicable.