4.3

CVE-2012-1561

Cross-site scripting (XSS) vulnerability in the Finder module 6.x-1.x before 6.x-1.26, 7.x-1.x, and 7.x-2.x before 7.x-2.0-alpha8 for Drupal allows remote attackers to inject arbitrary web script or HTML via unspecified vectors related to the "checkbox and radio button functionalities."
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Danielb ≫ Finder Version 6.x-1.0
Danielb ≫ Finder Version 6.x-1.0 Update alpha1
Danielb ≫ Finder Version 6.x-1.0 Update alpha10
Danielb ≫ Finder Version 6.x-1.0 Update alpha11
Danielb ≫ Finder Version 6.x-1.0 Update alpha12
Danielb ≫ Finder Version 6.x-1.0 Update alpha13
Danielb ≫ Finder Version 6.x-1.0 Update alpha14
Danielb ≫ Finder Version 6.x-1.0 Update alpha15
Danielb ≫ Finder Version 6.x-1.0 Update alpha16
Danielb ≫ Finder Version 6.x-1.0 Update alpha17
Danielb ≫ Finder Version 6.x-1.0 Update alpha18
Danielb ≫ Finder Version 6.x-1.0 Update alpha19
Danielb ≫ Finder Version 6.x-1.0 Update alpha2
Danielb ≫ Finder Version 6.x-1.0 Update alpha20
Danielb ≫ Finder Version 6.x-1.0 Update alpha21
Danielb ≫ Finder Version 6.x-1.0 Update alpha22
Danielb ≫ Finder Version 6.x-1.0 Update alpha23
Danielb ≫ Finder Version 6.x-1.0 Update alpha24
Danielb ≫ Finder Version 6.x-1.0 Update alpha25
Danielb ≫ Finder Version 6.x-1.0 Update alpha26
Danielb ≫ Finder Version 6.x-1.0 Update alpha27
Danielb ≫ Finder Version 6.x-1.0 Update alpha28
Danielb ≫ Finder Version 6.x-1.0 Update alpha3
Danielb ≫ Finder Version 6.x-1.0 Update alpha4
Danielb ≫ Finder Version 6.x-1.0 Update alpha5
Danielb ≫ Finder Version 6.x-1.0 Update alpha6
Danielb ≫ Finder Version 6.x-1.0 Update alpha7
Danielb ≫ Finder Version 6.x-1.0 Update alpha8
Danielb ≫ Finder Version 6.x-1.0 Update alpha9
Danielb ≫ Finder Version 6.x-1.0 Update beta1
Danielb ≫ Finder Version 6.x-1.0 Update beta2
Danielb ≫ Finder Version 6.x-1.0 Update beta3
Danielb ≫ Finder Version 6.x-1.0 Update rc1
Danielb ≫ Finder Version 6.x-1.0 Update rc2
Danielb ≫ Finder Version 6.x-1.0 Update rc3
Danielb ≫ Finder Version 6.x-1.0 Update rc4
Danielb ≫ Finder Version 6.x-1.0 Update unstable0
Danielb ≫ Finder Version 6.x-1.0 Update unstable1
Danielb ≫ Finder Version 6.x-1.0 Update unstable2
Danielb ≫ Finder Version 6.x-1.0 Update unstable3
Danielb ≫ Finder Version 6.x-1.0 Update unstable4
Danielb ≫ Finder Version 6.x-1.0 Update unstable5
Danielb ≫ Finder Version 6.x-1.0 Update unstable6
Danielb ≫ Finder Version 6.x-1.0 Update unstable7
Danielb ≫ Finder Version 6.x-1.1
Danielb ≫ Finder Version 6.x-1.2
Danielb ≫ Finder Version 6.x-1.3
Danielb ≫ Finder Version 6.x-1.4
Danielb ≫ Finder Version 6.x-1.5
Danielb ≫ Finder Version 6.x-1.6
Danielb ≫ Finder Version 6.x-1.7
Danielb ≫ Finder Version 6.x-1.8
Danielb ≫ Finder Version 6.x-1.9
Danielb ≫ Finder Version 6.x-1.10
Danielb ≫ Finder Version 6.x-1.11
Danielb ≫ Finder Version 6.x-1.12
Danielb ≫ Finder Version 6.x-1.13
Danielb ≫ Finder Version 6.x-1.14
Danielb ≫ Finder Version 6.x-1.15
Danielb ≫ Finder Version 6.x-1.16
Danielb ≫ Finder Version 6.x-1.17
Danielb ≫ Finder Version 6.x-1.18
Danielb ≫ Finder Version 6.x-1.19
Danielb ≫ Finder Version 6.x-1.20
Danielb ≫ Finder Version 6.x-1.21
Danielb ≫ Finder Version 6.x-1.23
Danielb ≫ Finder Version 6.x-1.24
Danielb ≫ Finder Version 6.x-1.25
Danielb ≫ Finder Version 6.x-1.x-dev
Danielb ≫ Finder Version 7.x-1.0
Danielb ≫ Finder Version 7.x-1.1
Danielb ≫ Finder Version 7.x-1.2
Danielb ≫ Finder Version 7.x-1.3
Danielb ≫ Finder Version 7.x-1.4
Danielb ≫ Finder Version 7.x-1.5
Danielb ≫ Finder Version 7.x-1.6
Danielb ≫ Finder Version 7.x-1.x Update dev
Danielb ≫ Finder Version 7.x-2.0 Update alpha1
Danielb ≫ Finder Version 7.x-2.0 Update alpha2
Danielb ≫ Finder Version 7.x-2.0 Update alpha3
Danielb ≫ Finder Version 7.x-2.0 Update alpha4
Danielb ≫ Finder Version 7.x-2.0 Update alpha5
Danielb ≫ Finder Version 7.x-2.0 Update alpha6
Danielb ≫ Finder Version 7.x-2.x Update dev
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 3.04% 0.859
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
NIST 4.3 8.6 2.9
AV:N/AC:M/Au:N/C:N/I:P/A:N
CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

http://www.openwall.com/lists/oss-security/2012/04/07/1
http://drupal.org/node/1432318
http://drupal.org/node/1432320
http://secunia.com/advisories/47943
Vendor Advisory
http://www.madirish.net/content/drupal-finder-6x-19-xss-and-remote-code-execution-vulnerabilities
http://www.openwall.com/lists/oss-security/2012/03/16/9
http://www.openwall.com/lists/oss-security/2012/03/19/9
https://drupal.org/node/1432970
Patch
Vendor Advisory
http://drupalcode.org/project/finder.git/commit/13e2d0c
http://drupalcode.org/project/finder.git/commit/58443aa
http://secunia.com/advisories/47941
http://www.osvdb.org/79015
https://exchange.xforce.ibmcloud.com/vulnerabilities/73110