4.9 Medium
CVSS2
Attack Vector
NETWORK
Attack Complexity
MEDIUM
Authentication
SINGLE
Confidentiality Impact
NONE
Integrity Impact
PARTIAL
Availability Impact
PARTIAL
AV:N/AC:M/Au:S/C:N/I:P/A:P
0.967 High
EPSS
Percentile
99.7%
Cool aid is a Drupal module that allows users to add custom help messages to Drupal pages. The module did not properly clean user input before displaying it, and did not properly check for access permissions, allowing users with “administer coolaid” to inject scripts anywhere on a site.
The XSS issue is
CVE: CVE-2012-1648
The Access Bypass issue is
CVE: CVE-2012-1649
Drupal core is not affected. If you do not use the contributed Cool aid; Editable help messages module, there is nothing you need to do.
Install the latest version:
See also the Cool aid; Editable help messages project page.