CVE-2012-3799

The CVE-2012-3799 entry concerns the Drupal Maestro module (7.x-1.x) prior to 7.x-1.2, where inadequate validation of user input in admin screens enabled CSRF and XSS, allowing an attacker to hijack administrator actions (including workflow changes) via authenticated sessions. The advisory confir...

SA-CONTRIB-2012-094 - Maestro module - Cross Site Request Forgery (CSRF), Cross Site Scripting (XSS)

The Maestro module is a workflow engine/solution that facilitates simple and complex business process automation. The module doesn't sufficiently filter user-supplied data in its admin screens leading to a Cross Site Scripting XSS vulnerability. A Cross Site Request Forgery vulnerability in the...