4.3

CVE-2014-8765

Multiple cross-site scripting (XSS) vulnerabilities in the Project Issue File Review module (PIFR) module 6.x-2.x before 6.x-2.17 for Drupal allow (1) remote attackers to inject arbitrary web script or HTML via a crafted patch, which triggers a PIFR client to test the patch and return the results to the PIFR_Server test results page or (2) remote authenticated users with the "manage PIFR environments" permission to inject arbitrary web script or HTML via vectors involving a PIFR_Server administrative page.

Data is provided by the National Vulnerability Database (NVD)
Drupal ≫ Project Issue File Review Version <= 6.x-2.16
Drupal ≫ Project Issue File Review Version6.x-2.00
Drupal ≫ Project Issue File Review Version6.x-2.01
Drupal ≫ Project Issue File Review Version6.x-2.02
Drupal ≫ Project Issue File Review Version6.x-2.03
Drupal ≫ Project Issue File Review Version6.x-2.04
Drupal ≫ Project Issue File Review Version6.x-2.05
Drupal ≫ Project Issue File Review Version6.x-2.06
Drupal ≫ Project Issue File Review Version6.x-2.07
Drupal ≫ Project Issue File Review Version6.x-2.08
Drupal ≫ Project Issue File Review Version6.x-2.08 Updaterc1
Drupal ≫ Project Issue File Review Version6.x-2.08 Updaterc2
Drupal ≫ Project Issue File Review Version6.x-2.08 Updaterc3
Drupal ≫ Project Issue File Review Version6.x-2.08 Updaterc4
Drupal ≫ Project Issue File Review Version6.x-2.10
Drupal ≫ Project Issue File Review Version6.x-2.12
Drupal ≫ Project Issue File Review Version6.x-2.12 Updatealpha1
Drupal ≫ Project Issue File Review Version6.x-2.12 Updaterc1
Drupal ≫ Project Issue File Review Version6.x-2.13
Drupal ≫ Project Issue File Review Version6.x-2.14
Drupal ≫ Project Issue File Review Version6.x-2.14 Updatebeta1
Drupal ≫ Project Issue File Review Version6.x-2.14 Updatebeta2
Drupal ≫ Project Issue File Review Version6.x-2.14 Updatebeta3
Drupal ≫ Project Issue File Review Version6.x-2.14 Updatebeta4
Drupal ≫ Project Issue File Review Version6.x-2.14 Updatebeta5
Drupal ≫ Project Issue File Review Version6.x-2.15
Drupal ≫ Project Issue File Review Version6.x-2.15 Updaterc1
Drupal ≫ Project Issue File Review Version6.x-2.15 Updaterc2
Zu dieser CVE wurde keine CISA KEV oder CERT.AT-Warnung gefunden.
EPSS Metriken
Type Source Score Percentile
EPSS FIRST.org 0.29% 0.49
CVSS Metriken
Source Base Score Exploit Score Impact Score Vector string
nvd@nist.gov 4.3 8.6 2.9
AV:N/AC:M/Au:N/C:N/I:P/A:N
CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.