Cross site scripting

2011-07-0822:55:00

PRIOn knowledge base

www.prio-n.com

5.8 Medium

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

44.0%

JSON

Cross-site scripting (XSS) vulnerability in the Category Tokens module 6.x before 6.x-1.1 for Drupal allows remote authenticated users with administer taxonomy permissions to inject arbitrary web script or HTML by editing or creating vocabulary names, which are not properly handled in token help.

CPENameOperatorVersion
category_tokenseq6.120.10

CPE	Name	Operator	Version
	category_tokens	eq	6.120.10

References

osvdb.org/69145

secunia.com/advisories/42168

www.securityfocus.com/bid/44780

drupal.org/node/968176

exchange.xforce.ibmcloud.com/vulnerabilities/63203