Lucene search
MitreCVE-2014-8077HistoryOct 09, 2014 - 2:55 p.m.
CVE-2014-8077
2014-10-0914:55:06
CWE-79
mitre
web.nvd.nist.gov
20
cve-2014-8077
cross-site scripting
xss
newsflash theme
drupal
nvd
security vulnerability
web security
CVSS2
3.5
Attack Vector
NETWORK
Attack Complexity
MEDIUM
Authentication
SINGLE
Confidentiality Impact
NONE
Integrity Impact
PARTIAL
Availability Impact
NONE
AV:N/AC:M/Au:S/C:N/I:P/A:N
AI Score
5.4
Confidence
High
EPSS
0.001
Percentile
45.0%
Cross-site scripting (XSS) vulnerability in the NewsFlash theme 6.x-1.x before 6.x-1.7 and 7.x-1.x before 7.x-2.5 for Drupal allows remote authenticated users with the “administer themes” permission to inject arbitrary web script or HTML via vectors related to font family CSS property.
Affected configurations
Node
drupalnewsflashMatch6.x-1.6
ORdrupalnewsflashMatch6.x-1.x-dev
ORdrupalnewsflashMatch7.x-1.x-dev
ORdrupalnewsflashMatch7.x-2.0
ORdrupalnewsflashMatch7.x-2.1
ORdrupalnewsflashMatch7.x-2.2
ORdrupalnewsflashMatch7.x-2.3
ORdrupalnewsflashMatch7.x-2.4
ORdrupalnewsflashMatch7.x-2.x-dev
| Vendor | Product | Version | CPE |
|---|---|---|---|
| drupal | newsflash | 6.x-1.6 | cpe:2.3:a:drupal:newsflash:6.x-1.6:*:*:*:*:*:*:* |
| drupal | newsflash | 6.x-1.x-dev | cpe:2.3:a:drupal:newsflash:6.x-1.x-dev:*:*:*:*:*:*:* |
| drupal | newsflash | 7.x-1.x-dev | cpe:2.3:a:drupal:newsflash:7.x-1.x-dev:*:*:*:*:*:*:* |
| drupal | newsflash | 7.x-2.0 | cpe:2.3:a:drupal:newsflash:7.x-2.0:*:*:*:*:*:*:* |
| drupal | newsflash | 7.x-2.1 | cpe:2.3:a:drupal:newsflash:7.x-2.1:*:*:*:*:*:*:* |
| drupal | newsflash | 7.x-2.2 | cpe:2.3:a:drupal:newsflash:7.x-2.2:*:*:*:*:*:*:* |
| drupal | newsflash | 7.x-2.3 | cpe:2.3:a:drupal:newsflash:7.x-2.3:*:*:*:*:*:*:* |
| drupal | newsflash | 7.x-2.4 | cpe:2.3:a:drupal:newsflash:7.x-2.4:*:*:*:*:*:*:* |
| drupal | newsflash | 7.x-2.x-dev | cpe:2.3:a:drupal:newsflash:7.x-2.x-dev:*:*:*:*:*:*:* |
Related
cvelist
cvelist
CVE-2014-8077
2014-10-09 14:00:00
prion
prion
Cross site scripting
2014-10-09 14:55:00
drupal
drupal
SA-CONTRIB-2014-027 - NewsFlash Theme - XSS
2014-03-05 00:00:00
nvd
nvd
CVE-2014-8077
2014-10-09 14:55:06
CVSS2
3.5
Attack Vector
NETWORK
Attack Complexity
MEDIUM
Authentication
SINGLE
Confidentiality Impact
NONE
Integrity Impact
PARTIAL
Availability Impact
NONE
AV:N/AC:M/Au:S/C:N/I:P/A:N
AI Score
5.4
Confidence
High
EPSS
0.001
Percentile
45.0%
Related for CVE-2014-8077