2.1 Low
CVSS2
Attack Vector
NETWORK
Attack Complexity
HIGH
Authentication
SINGLE
Confidentiality Impact
NONE
Integrity Impact
PARTIAL
Availability Impact
NONE
AV:N/AC:H/Au:S/C:N/I:P/A:N
0.967 High
EPSS
Percentile
99.7%
CVE: CVE-2012-1654
This module enables you to create arbitrary tables in your Drupal database and manage the data in them, and also manage data in existing tables such as those created by or imported from a third-party application.
The module doesn’t sufficiently escape the human-readable title that is given to a new table by the admin, thus allowing arbitrary scripts to be run on the site.
This vulnerability is mitigated by the fact that an attacker must have a role with the permission “administer data tables”.
Drupal core is not affected. If you do not use the contributed Data module, there is nothing you need to do.
Install the latest version:
See also the Data project page.