Lucene search

[email protected]CVE-2012-2298

HistoryAug 14, 2012 - 10:55 p.m.

CVE-2012-2298

2012-08-1422:55:02

CWE-79

[email protected]

web.nvd.nist.gov

cve

2012

2298

realname module

drupal

xss

vulnerabilities

web script

html

nvd

4.3 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:N/C:N/I:P/A:N

5.8 Medium

AI Score

Confidence

High

0.005 Low

EPSS

Percentile

76.2%

JSON

Multiple cross-site scripting (XSS) vulnerabilities in the RealName module 6.x-1.x before 6.x-1.5 for Drupal allow remote attackers to inject arbitrary web script or HTML via vectors related to (1) “user names in page titles” and (2) “autocomplete callbacks.”

Affected configurations

NVD

Node

drupalrealnameMatch6.x-1.2

nancy_wichmannrealnameMatch6.x-1.0

nancy_wichmannrealnameMatch6.x-1.0alpha1

nancy_wichmannrealnameMatch6.x-1.0beta

nancy_wichmannrealnameMatch6.x-1.1

nancy_wichmannrealnameMatch6.x-1.1rc1

nancy_wichmannrealnameMatch6.x-1.1rc2

nancy_wichmannrealnameMatch6.x-1.1rc3

nancy_wichmannrealnameMatch6.x-1.2

nancy_wichmannrealnameMatch6.x-1.3

nancy_wichmannrealnameMatch6.x-1.4

nancy_wichmannrealnameMatch6.x-1.xdev

AND

drupaldrupalMatch-

CPENameOperatorVersion
drupal:realnamedrupal realnameeq6.x-1.2
nancy_wichmann:realnamenancy wichmann realnameeq6.x-1.0
nancy_wichmann:realnamenancy wichmann realnameeq6.x-1.1
nancy_wichmann:realnamenancy wichmann realnameeq6.x-1.2
nancy_wichmann:realnamenancy wichmann realnameeq6.x-1.3
nancy_wichmann:realnamenancy wichmann realnameeq6.x-1.4
nancy_wichmann:realnamenancy wichmann realnameeq6.x-1.x

CPE	Name	Operator	Version
drupal:realname	drupal realname	eq	6.x-1.2
nancy_wichmann:realname	nancy wichmann realname	eq	6.x-1.0
nancy_wichmann:realname	nancy wichmann realname	eq	6.x-1.1
nancy_wichmann:realname	nancy wichmann realname	eq	6.x-1.2
nancy_wichmann:realname	nancy wichmann realname	eq	6.x-1.3
nancy_wichmann:realname	nancy wichmann realname	eq	6.x-1.4
nancy_wichmann:realname	nancy wichmann realname	eq	6.x-1.x

References

drupal.org/node/1547352

drupal.org/node/1547660

drupalcode.org/project/realname.git/commitdiff/41786d0

drupalcode.org/project/realname.git/commitdiff/b920794

secunia.com/advisories/48936

www.openwall.com/lists/oss-security/2012/05/03/1

www.openwall.com/lists/oss-security/2012/05/03/2

www.securityfocus.com/bid/53250

exchange.xforce.ibmcloud.com/vulnerabilities/75181

4.3 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:N/C:N/I:P/A:N

5.8 Medium

AI Score

Confidence

High

0.005 Low

EPSS

Percentile

76.2%

JSON

Related for CVE-2012-2298

drupal1 prion1 cvelist1 nvd1