2.1
CVE-2011-5187
- EPSS 1.04%
- Veröffentlicht 20.09.2012 10:55:28
- Zuletzt bearbeitet 16.06.2026 23:36:06
- Quelle cve@mitre.org
- CVE-Watchlists
- Unerledigt
LoginCross-site scripting (XSS) vulnerability in the Support Ticketing System module 6.x-1.x before 6.x-1.7 for Drupal allows remote authenticated users with the "administer support projects" permission to inject arbitrary web script or HTML via unspecified vectors.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Tag1consulting ≫ Support Version6.x-1.0
Tag1consulting ≫ Support Version6.x-1.0 Updaterc1
Tag1consulting ≫ Support Version6.x-1.0 Updaterc2
Tag1consulting ≫ Support Version6.x-1.1 Updaterc1
Tag1consulting ≫ Support Version6.x-1.2
Tag1consulting ≫ Support Version6.x-1.2 Updaterc1
Tag1consulting ≫ Support Version6.x-1.3
Tag1consulting ≫ Support Version6.x-1.3 Updaterc1
Tag1consulting ≫ Support Version6.x-1.4
Tag1consulting ≫ Support Version6.x-1.4 Updaterc1
Tag1consulting ≫ Support Version6.x-1.5
Tag1consulting ≫ Support Version6.x-1.5 Updaterc1
Tag1consulting ≫ Support Version6.x-1.6 Updaterc1
Tag1consulting ≫ Support Version6.x-1.x Updatedev
| Typ | Quelle | Score | Percentile |
|---|---|---|---|
| EPSS | FIRST.org | 1.04% | 0.595 |
| Quelle | Base Score | Exploit Score | Impact Score | Vector String |
|---|---|---|---|---|
| nvd@nist.gov | 2.1 | 3.9 | 2.9 |
AV:N/AC:H/Au:S/C:N/I:P/A:N
|
CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
http://drupal.org/node/1357300
http://drupal.org/node/1357378
http://secunia.com/advisories/47056
http://www.osvdb.org/77424
http://www.securityfocus.com/bid/50871
https://exchange.xforce.ibmcloud.com/vulnerabilities/71598