2.1

CVE-2012-2705

The filter_titles function in the Smart Breadcrumb module 6.x-1.x before 6.x-1.3 for Drupal does not properly convert a title to plain-text, which allows remote authenticated users with create or edit node permissions to conduct cross-site scripting (XSS) attacks via the title parameter.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Christopher Mitchell ≫ Smart Breadcrumb Version6.x-1.0
   Drupal ≫ Drupal Version-
Christopher Mitchell ≫ Smart Breadcrumb Version6.x-1.1
   Drupal ≫ Drupal Version-
Christopher Mitchell ≫ Smart Breadcrumb Version6.x-1.2
   Drupal ≫ Drupal Version-
Christopher Mitchell ≫ Smart Breadcrumb Version6.x-1.x Updatedev
   Drupal ≫ Drupal Version-
Zu dieser CVE wurde keine CISA KEV oder CERT.AT-Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 0.32% 0.551
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
nvd@nist.gov 2.1 3.9 2.9
AV:N/AC:H/Au:S/C:N/I:P/A:N
CWE-20 Improper Input Validation

The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.

http://drupal.org/node/1585564
Patch
Vendor Advisory