Cross site scripting

2010-06-2119:30:00

PRIOn knowledge base

www.prio-n.com

5.8 Medium

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

43.5%

JSON

Cross-site scripting (XSS) vulnerability in the FileField module 5.x before 5.x-2.5 and 6.x before 6.x-3.4 for Drupal allows remote authenticated users, with create or edit permissions and ‘Path to File’ or ‘URL to File’ display enabled, to inject arbitrary web script or HTML via the file name (filepath parameter).

CPENameOperatorVersion
filefieldeq5.0.0-x1-xdev
filefieldeq5.120.20
filefieldeq5.120.21
filefieldeq5.120.22
filefieldeq5.120.23
filefieldeq5.x-2.3 rc3
filefieldeq5.x-2.3 rc2
filefieldeq5.x-2.3 rc4
filefieldeq5.120.24
filefieldeq5.0.0-x2-xdev

Name	Operator	Version
filefield	eq	5.0.0-x1-xdev
filefield	eq	5.120.20
filefield	eq	5.120.21
filefield	eq	5.120.22
filefield	eq	5.120.23
filefield	eq	5.x-2.3 rc3
filefield	eq	5.x-2.3 rc2
filefield	eq	5.x-2.3 rc4
filefield	eq	5.120.24
filefield	eq	5.0.0-x2-xdev

Rows per page:

1-10 of 331

References

osvdb.org/65611

secunia.com/advisories/40186

www.madirish.net/?article=461

www.securityfocus.com/bid/40923

drupal.org/node/829808

exchange.xforce.ibmcloud.com/vulnerabilities/59500