Lucene search

PRIOn knowledge basePRION:CVE-2012-1660

HistorySep 18, 2012 - 8:55 p.m.

Cross site scripting

2012-09-1820:55:00

PRIOn knowledge base

www.prio-n.com

5.6 Medium

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

46.2%

JSON

Multiple cross-site scripting (XSS) vulnerabilities in components/select.inc in the Webform module 6.x-3.x before 6.x-3.17 and 7.x-3.x before 7.x-3.17 for Drupal, when the “Select (or other)” module is enabled, allow remote authenticated users with the create webform content permission to inject arbitrary web script or HTML via vectors related to (1) checkboxes or (2) radios.

CPENameOperatorVersion
webformeq6.120.30
webformeq6.x-3.0 beta3
webformeq6.x-3.0 beta1
webformeq6.x-3.0 beta6
webformeq6.x-3.0 beta5
webformeq6.x-3.0 beta2
webformeq6.x-3.0 beta4
webformeq6.120.31
webformeq6.120.32
webformeq6.120.33

Name	Operator	Version
webform	eq	6.120.30
webform	eq	6.x-3.0 beta3
webform	eq	6.x-3.0 beta1
webform	eq	6.x-3.0 beta6
webform	eq	6.x-3.0 beta5
webform	eq	6.x-3.0 beta2
webform	eq	6.x-3.0 beta4
webform	eq	6.120.31
webform	eq	6.120.32
webform	eq	6.120.33

Rows per page:

1-10 of 441

References

drupalcode.org/project/webform.git/commit/90af819

drupalcode.org/project/webform.git/commit/917fa91

secunia.com/advisories/48310

www.openwall.com/lists/oss-security/2012/04/07/1

www.osvdb.org/79852

www.securityfocus.com/bid/52345

drupal.org/node/1472178

drupal.org/node/1472180

drupal.org/node/1472214

exchange.xforce.ibmcloud.com/vulnerabilities/73779