4.3

CVE-2014-8765

Multiple cross-site scripting (XSS) vulnerabilities in the Project Issue File Review module (PIFR) module 6.x-2.x before 6.x-2.17 for Drupal allow (1) remote attackers to inject arbitrary web script or HTML via a crafted patch, which triggers a PIFR client to test the patch and return the results to the PIFR_Server test results page or (2) remote authenticated users with the "manage PIFR environments" permission to inject arbitrary web script or HTML via vectors involving a PIFR_Server administrative page.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Drupal ≫ Project Issue File Review Version <= 6.x-2.16
Drupal ≫ Project Issue File Review Version 6.x-2.00
Drupal ≫ Project Issue File Review Version 6.x-2.01
Drupal ≫ Project Issue File Review Version 6.x-2.02
Drupal ≫ Project Issue File Review Version 6.x-2.03
Drupal ≫ Project Issue File Review Version 6.x-2.04
Drupal ≫ Project Issue File Review Version 6.x-2.05
Drupal ≫ Project Issue File Review Version 6.x-2.06
Drupal ≫ Project Issue File Review Version 6.x-2.07
Drupal ≫ Project Issue File Review Version 6.x-2.08
Drupal ≫ Project Issue File Review Version 6.x-2.08 Update rc1
Drupal ≫ Project Issue File Review Version 6.x-2.08 Update rc2
Drupal ≫ Project Issue File Review Version 6.x-2.08 Update rc3
Drupal ≫ Project Issue File Review Version 6.x-2.08 Update rc4
Drupal ≫ Project Issue File Review Version 6.x-2.10
Drupal ≫ Project Issue File Review Version 6.x-2.12
Drupal ≫ Project Issue File Review Version 6.x-2.12 Update alpha1
Drupal ≫ Project Issue File Review Version 6.x-2.12 Update rc1
Drupal ≫ Project Issue File Review Version 6.x-2.13
Drupal ≫ Project Issue File Review Version 6.x-2.14
Drupal ≫ Project Issue File Review Version 6.x-2.14 Update beta1
Drupal ≫ Project Issue File Review Version 6.x-2.14 Update beta2
Drupal ≫ Project Issue File Review Version 6.x-2.14 Update beta3
Drupal ≫ Project Issue File Review Version 6.x-2.14 Update beta4
Drupal ≫ Project Issue File Review Version 6.x-2.14 Update beta5
Drupal ≫ Project Issue File Review Version 6.x-2.15
Drupal ≫ Project Issue File Review Version 6.x-2.15 Update rc1
Drupal ≫ Project Issue File Review Version 6.x-2.15 Update rc2
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 1.16% 0.63
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
NIST 4.3 8.6 2.9
AV:N/AC:M/Au:N/C:N/I:P/A:N
CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

http://secunia.com/advisories/57030
http://www.securityfocus.com/bid/65830
https://www.drupal.org/node/2205755
Patch
https://www.drupal.org/node/2205767
Vendor Advisory