2.1
CVE-2015-6752
- EPSS 0.14%
- Veröffentlicht 31.08.2015 18:59:12
- Zuletzt bearbeitet 12.04.2025 10:46:40
- Quelle cve@mitre.org
- CVE-Watchlists
- Unerledigt
LoginCross-site scripting (XSS) vulnerability in the Search API Autocomplete module 7.x-1.x before 7.x-1.3 for Drupal, when the search index is configured to use the HTML filter processor, allows remote authenticated users with certain permissions to inject arbitrary web script or HTML via unspecified vectors, which are not properly handled in the returned suggestions.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Search Api Autocomplete Project ≫ Search Api Autocomplete Version7.x-1.0 SwPlatformdrupal
Search Api Autocomplete Project ≫ Search Api Autocomplete Version7.x-1.1 SwPlatformdrupal
Search Api Autocomplete Project ≫ Search Api Autocomplete Version7.x-1.2 SwPlatformdrupal
| Typ | Quelle | Score | Percentile |
|---|---|---|---|
| EPSS | FIRST.org | 0.14% | 0.306 |
| Quelle | Base Score | Exploit Score | Impact Score | Vector String |
|---|---|---|---|---|
| nvd@nist.gov | 2.1 | 3.9 | 2.9 |
AV:N/AC:H/Au:S/C:N/I:P/A:N
|
CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.