6.8

CVE-2011-0771

The Janrain Engage (formerly RPX) module 6.x-1.3 for Drupal does not validate the file for a profile image, which allows remote authenticated users to conduct cross-site scripting (XSS) attacks and possibly execute arbitrary PHP code by causing a crafted avatar to be downloaded from an external login provider site.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Janrain ≫ Rpx Version6.x-1.3
   Drupal ≫ Drupal Version-
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 2.06% 0.789
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
nvd@nist.gov 6.8 8.6 6.4
AV:N/AC:M/Au:N/C:P/I:P/A:P
CWE-20 Improper Input Validation

The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.

http://drupal.org/node/1033154
Patch
Vendor Advisory
http://osvdb.org/70623
http://secunia.com/advisories/42980
Vendor Advisory
http://www.securityfocus.com/bid/45926
Patch
https://exchange.xforce.ibmcloud.com/vulnerabilities/64847
https://exchange.xforce.ibmcloud.com/vulnerabilities/64848