Lucene search

RedhatCVE-2012-4485

HistoryOct 31, 2012 - 4:55 p.m.

CVE-2012-4485

2012-10-3116:55:02

CWE-79

redhat

web.nvd.nist.gov

cve-2012-4485

xss vulnerabilities

galleryformatter

drupal 7.x-1.2

nvd

security document

information security

CVSS2

4.3

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:N/C:N/I:P/A:N

AI Score

5.5

Confidence

High

EPSS

0.002

Percentile

64.8%

JSON

Multiple cross-site scripting (XSS) vulnerabilities in the galleryformatter_field_formatter_view functiuon in galleryformatter.tpl.php the Gallery formatter module before 7.x-1.2 for Drupal allow remote authenticated users with permissions to create a node or entity to inject arbitrary web script or HTML via the (1) title or (2) alt parameter.

Affected configurations

Nvd

Node

manuel_garciagalleryformatterRange≤7.x-1.1

manuel_garciagalleryformatterMatch6.x-1.0rc1

manuel_garciagalleryformatterMatch6.x-1.0rc2

manuel_garciagalleryformatterMatch6.x-1.0rc3

manuel_garciagalleryformatterMatch6.x-1.0rc4

manuel_garciagalleryformatterMatch6.x-1.xdev

manuel_garciagalleryformatterMatch7.x-1.0

manuel_garciagalleryformatterMatch7.x-1.xdev

AND

drupaldrupalMatch-

VendorProductVersionCPE
manuel_garciagalleryformatter*cpe:2.3:a:manuel_garcia:galleryformatter:*:*:*:*:*:*:*:*
manuel_garciagalleryformatter6.x-1.0cpe:2.3:a:manuel_garcia:galleryformatter:6.x-1.0:rc1:*:*:*:*:*:*
manuel_garciagalleryformatter6.x-1.0cpe:2.3:a:manuel_garcia:galleryformatter:6.x-1.0:rc2:*:*:*:*:*:*
manuel_garciagalleryformatter6.x-1.0cpe:2.3:a:manuel_garcia:galleryformatter:6.x-1.0:rc3:*:*:*:*:*:*
manuel_garciagalleryformatter6.x-1.0cpe:2.3:a:manuel_garcia:galleryformatter:6.x-1.0:rc4:*:*:*:*:*:*
manuel_garciagalleryformatter6.x-1.xcpe:2.3:a:manuel_garcia:galleryformatter:6.x-1.x:dev:*:*:*:*:*:*
manuel_garciagalleryformatter7.x-1.0cpe:2.3:a:manuel_garcia:galleryformatter:7.x-1.0:*:*:*:*:*:*:*
manuel_garciagalleryformatter7.x-1.xcpe:2.3:a:manuel_garcia:galleryformatter:7.x-1.x:dev:*:*:*:*:*:*
drupaldrupal-cpe:2.3:a:drupal:drupal:-:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
manuel_garcia	galleryformatter	*	cpe:2.3:a:manuel_garcia:galleryformatter::::::::
manuel_garcia	galleryformatter	6.x-1.0	cpe:2.3:a:manuel_garcia:galleryformatter:6.x-1.0:rc1::::::
manuel_garcia	galleryformatter	6.x-1.0	cpe:2.3:a:manuel_garcia:galleryformatter:6.x-1.0:rc2::::::
manuel_garcia	galleryformatter	6.x-1.0	cpe:2.3:a:manuel_garcia:galleryformatter:6.x-1.0:rc3::::::
manuel_garcia	galleryformatter	6.x-1.0	cpe:2.3:a:manuel_garcia:galleryformatter:6.x-1.0:rc4::::::
manuel_garcia	galleryformatter	6.x-1.x	cpe:2.3:a:manuel_garcia:galleryformatter:6.x-1.x:dev::::::
manuel_garcia	galleryformatter	7.x-1.0	cpe:2.3:a:manuel_garcia:galleryformatter:7.x-1.0:::::::*
manuel_garcia	galleryformatter	7.x-1.x	cpe:2.3:a:manuel_garcia:galleryformatter:7.x-1.x:dev::::::
drupal	drupal	-	cpe:2.3:a:drupal:drupal:-:::::::*

References

drupal.org/node/1699744

drupal.org/node/1700578

drupalcode.org/project/galleryformatter.git/commitdiff/b0392a1

www.openwall.com/lists/oss-security/2012/10/04/6

www.openwall.com/lists/oss-security/2012/10/07/1

www.securityfocus.com/bid/54674

CVSS2

4.3

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:N/C:N/I:P/A:N

AI Score

5.5

Confidence

High

EPSS

0.002

Percentile

64.8%

JSON

Related for CVE-2012-4485