Lucene search

[email protected]CVE-2015-4357

HistoryJun 15, 2015 - 2:59 p.m.

CVE-2015-4357

2015-06-1514:59:11

CWE-79

[email protected]

web.nvd.nist.gov

drupal

webform

xss

vulnerability

cve-2015-4357

nvd

3.5 Low

CVSS2

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

SINGLE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:S/C:N/I:P/A:N

5.5 Medium

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

45.9%

JSON

Cross-site scripting (XSS) vulnerability in the Webform module before 6.x-3.22, 7.x-3.x before 7.x-3.22, and 7.x-4.x before 7.x-4.4 for Drupal allows remote authenticated users with certain permissions to inject arbitrary web script or HTML via a node title, which is used as the default title of a webform block.

Affected configurations

NVD

Node

webform_projectwebformRange≤6.x-3.21drupal

webform_projectwebformMatch7.x-3.0drupal

webform_projectwebformMatch7.x-3.1drupal

webform_projectwebformMatch7.x-3.2drupal

webform_projectwebformMatch7.x-3.3drupal

webform_projectwebformMatch7.x-3.4drupal

webform_projectwebformMatch7.x-3.5drupal

webform_projectwebformMatch7.x-3.6drupal

webform_projectwebformMatch7.x-3.7drupal

webform_projectwebformMatch7.x-3.8drupal

webform_projectwebformMatch7.x-3.9drupal

webform_projectwebformMatch7.x-3.10drupal

webform_projectwebformMatch7.x-3.11drupal

webform_projectwebformMatch7.x-3.12drupal

webform_projectwebformMatch7.x-3.13drupal

webform_projectwebformMatch7.x-3.14drupal

webform_projectwebformMatch7.x-3.15drupal

webform_projectwebformMatch7.x-3.16drupal

webform_projectwebformMatch7.x-3.17drupal

webform_projectwebformMatch7.x-3.18drupal

webform_projectwebformMatch7.x-3.19drupal

webform_projectwebformMatch7.x-3.20drupal

webform_projectwebformMatch7.x-3.21drupal

webform_projectwebformMatch7.x-4.0drupal

webform_projectwebformMatch7.x-4.1drupal

webform_projectwebformMatch7.x-4.2drupal

webform_projectwebformMatch7.x-4.3drupal

CPENameOperatorVersion
webform_project:webformwebform project webformle6.x-3.21
webform_project:webformwebform project webformeq7.x-3.0
webform_project:webformwebform project webformeq7.x-3.1
webform_project:webformwebform project webformeq7.x-3.2
webform_project:webformwebform project webformeq7.x-3.3
webform_project:webformwebform project webformeq7.x-3.4
webform_project:webformwebform project webformeq7.x-3.5
webform_project:webformwebform project webformeq7.x-3.6
webform_project:webformwebform project webformeq7.x-3.7
webform_project:webformwebform project webformeq7.x-3.8

CPE	Name	Operator	Version
webform_project:webform	webform project webform	le	6.x-3.21
webform_project:webform	webform project webform	eq	7.x-3.0
webform_project:webform	webform project webform	eq	7.x-3.1
webform_project:webform	webform project webform	eq	7.x-3.2
webform_project:webform	webform project webform	eq	7.x-3.3
webform_project:webform	webform project webform	eq	7.x-3.4
webform_project:webform	webform project webform	eq	7.x-3.5
webform_project:webform	webform project webform	eq	7.x-3.6
webform_project:webform	webform project webform	eq	7.x-3.7
webform_project:webform	webform project webform	eq	7.x-3.8

Rows per page:

1-10 of 271

References

www.openwall.com/lists/oss-security/2015/03/22/35

www.openwall.com/lists/oss-security/2015/04/25/6

www.securityfocus.com/bid/72993

www.drupal.org/node/2445291

www.drupal.org/node/2445295

www.drupal.org/node/2445297

www.drupal.org/node/2445935

3.5 Low

CVSS2

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

SINGLE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:S/C:N/I:P/A:N

5.5 Medium

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

45.9%

JSON

Related for CVE-2015-4357

nvd1 prion1 cvelist1 drupal1