Lucene search

[email protected]NVD:CVE-2014-8320

HistoryOct 17, 2014 - 2:55 p.m.

CVE-2014-8320

2014-10-1714:55:03

CWE-79

[email protected]

web.nvd.nist.gov

CVSS2

3.5

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

SINGLE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:S/C:N/I:P/A:N

AI Score

5.4

Confidence

High

EPSS

0.001

Percentile

44.5%

JSON

Cross-site scripting (XSS) vulnerability in the Custom Search module 6.x-1.x before 6.x-1.12 and 7.x-1.x before 7.x-1.14 for Drupal allows remote authenticated users with certain permissions to inject arbitrary web script or HTML via the “Label text” field to the results configuration page.

Affected configurations

Nvd

Node

custom_search_projectcustom_searchMatch6.x-1.0drupal

custom_search_projectcustom_searchMatch6.x-1.1drupal

custom_search_projectcustom_searchMatch6.x-1.2drupal

custom_search_projectcustom_searchMatch6.x-1.3drupal

custom_search_projectcustom_searchMatch6.x-1.4drupal

custom_search_projectcustom_searchMatch6.x-1.5drupal

custom_search_projectcustom_searchMatch6.x-1.6drupal

custom_search_projectcustom_searchMatch6.x-1.7drupal

custom_search_projectcustom_searchMatch6.x-1.8drupal

custom_search_projectcustom_searchMatch6.x-1.9drupal

custom_search_projectcustom_searchMatch6.x-1.10drupal

custom_search_projectcustom_searchMatch6.x-1.11drupal

custom_search_projectcustom_searchMatch7.x-1.0drupal

custom_search_projectcustom_searchMatch7.x-1.1drupal

custom_search_projectcustom_searchMatch7.x-1.2drupal

custom_search_projectcustom_searchMatch7.x-1.3drupal

custom_search_projectcustom_searchMatch7.x-1.4drupal

custom_search_projectcustom_searchMatch7.x-1.5drupal

custom_search_projectcustom_searchMatch7.x-1.6drupal

custom_search_projectcustom_searchMatch7.x-1.7drupal

custom_search_projectcustom_searchMatch7.x-1.8drupal

custom_search_projectcustom_searchMatch7.x-1.9drupal

custom_search_projectcustom_searchMatch7.x-1.10drupal

custom_search_projectcustom_searchMatch7.x-1.11drupal

custom_search_projectcustom_searchMatch7.x-1.12drupal

custom_search_projectcustom_searchMatch7.x-1.13drupal

VendorProductVersionCPE
custom_search_projectcustom_search6.x-1.0cpe:2.3:a:custom_search_project:custom_search:6.x-1.0:*:*:*:*:drupal:*:*
custom_search_projectcustom_search6.x-1.1cpe:2.3:a:custom_search_project:custom_search:6.x-1.1:*:*:*:*:drupal:*:*
custom_search_projectcustom_search6.x-1.2cpe:2.3:a:custom_search_project:custom_search:6.x-1.2:*:*:*:*:drupal:*:*
custom_search_projectcustom_search6.x-1.3cpe:2.3:a:custom_search_project:custom_search:6.x-1.3:*:*:*:*:drupal:*:*
custom_search_projectcustom_search6.x-1.4cpe:2.3:a:custom_search_project:custom_search:6.x-1.4:*:*:*:*:drupal:*:*
custom_search_projectcustom_search6.x-1.5cpe:2.3:a:custom_search_project:custom_search:6.x-1.5:*:*:*:*:drupal:*:*
custom_search_projectcustom_search6.x-1.6cpe:2.3:a:custom_search_project:custom_search:6.x-1.6:*:*:*:*:drupal:*:*
custom_search_projectcustom_search6.x-1.7cpe:2.3:a:custom_search_project:custom_search:6.x-1.7:*:*:*:*:drupal:*:*
custom_search_projectcustom_search6.x-1.8cpe:2.3:a:custom_search_project:custom_search:6.x-1.8:*:*:*:*:drupal:*:*
custom_search_projectcustom_search6.x-1.9cpe:2.3:a:custom_search_project:custom_search:6.x-1.9:*:*:*:*:drupal:*:*

Vendor	Product	Version	CPE
custom_search_project	custom_search	6.x-1.0	cpe:2.3:a:custom_search_project:custom_search:6.x-1.0:::::drupal::
custom_search_project	custom_search	6.x-1.1	cpe:2.3:a:custom_search_project:custom_search:6.x-1.1:::::drupal::
custom_search_project	custom_search	6.x-1.2	cpe:2.3:a:custom_search_project:custom_search:6.x-1.2:::::drupal::
custom_search_project	custom_search	6.x-1.3	cpe:2.3:a:custom_search_project:custom_search:6.x-1.3:::::drupal::
custom_search_project	custom_search	6.x-1.4	cpe:2.3:a:custom_search_project:custom_search:6.x-1.4:::::drupal::
custom_search_project	custom_search	6.x-1.5	cpe:2.3:a:custom_search_project:custom_search:6.x-1.5:::::drupal::
custom_search_project	custom_search	6.x-1.6	cpe:2.3:a:custom_search_project:custom_search:6.x-1.6:::::drupal::
custom_search_project	custom_search	6.x-1.7	cpe:2.3:a:custom_search_project:custom_search:6.x-1.7:::::drupal::
custom_search_project	custom_search	6.x-1.8	cpe:2.3:a:custom_search_project:custom_search:6.x-1.8:::::drupal::
custom_search_project	custom_search	6.x-1.9	cpe:2.3:a:custom_search_project:custom_search:6.x-1.9:::::drupal::

Rows per page:

1-10 of 261

References

seclists.org/fulldisclosure/2014/Apr/41

secunia.com/advisories/57373

drupal.org/node/2231665

exchange.xforce.ibmcloud.com/vulnerabilities/92347

www.drupal.org/node/2231531

www.drupal.org/node/2231533

CVSS2

3.5

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

SINGLE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:S/C:N/I:P/A:N

AI Score

5.4

Confidence

High

EPSS

0.001

Percentile

44.5%

JSON

Related for NVD:CVE-2014-8320

prion1 cve1 cvelist1