6.1

CVE-2016-7571

Cross-site scripting (XSS) vulnerability in Drupal 8.x before 8.1.10 allows remote attackers to inject arbitrary web script or HTML via vectors involving an HTTP exception.

Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Drupal ≫ Drupal Version8.0.0
Drupal ≫ Drupal Version8.0.0 Updatealpha10
Drupal ≫ Drupal Version8.0.0 Updatealpha11
Drupal ≫ Drupal Version8.0.0 Updatealpha12
Drupal ≫ Drupal Version8.0.0 Updatealpha13
Drupal ≫ Drupal Version8.0.0 Updatealpha14
Drupal ≫ Drupal Version8.0.0 Updatealpha15
Drupal ≫ Drupal Version8.0.0 Updatealpha2
Drupal ≫ Drupal Version8.0.0 Updatealpha3
Drupal ≫ Drupal Version8.0.0 Updatealpha4
Drupal ≫ Drupal Version8.0.0 Updatealpha5
Drupal ≫ Drupal Version8.0.0 Updatealpha6
Drupal ≫ Drupal Version8.0.0 Updatealpha7
Drupal ≫ Drupal Version8.0.0 Updatealpha8
Drupal ≫ Drupal Version8.0.0 Updatealpha9
Drupal ≫ Drupal Version8.0.0 Updatebeta1
Drupal ≫ Drupal Version8.0.0 Updatebeta10
Drupal ≫ Drupal Version8.0.0 Updatebeta11
Drupal ≫ Drupal Version8.0.0 Updatebeta12
Drupal ≫ Drupal Version8.0.0 Updatebeta13
Drupal ≫ Drupal Version8.0.0 Updatebeta14
Drupal ≫ Drupal Version8.0.0 Updatebeta15
Drupal ≫ Drupal Version8.0.0 Updatebeta16
Drupal ≫ Drupal Version8.0.0 Updatebeta2
Drupal ≫ Drupal Version8.0.0 Updatebeta3
Drupal ≫ Drupal Version8.0.0 Updatebeta4
Drupal ≫ Drupal Version8.0.0 Updatebeta6
Drupal ≫ Drupal Version8.0.0 Updatebeta7
Drupal ≫ Drupal Version8.0.0 Updatebeta9
Drupal ≫ Drupal Version8.0.0 Updaterc1
Drupal ≫ Drupal Version8.0.0 Updaterc2
Drupal ≫ Drupal Version8.0.0 Updaterc3
Drupal ≫ Drupal Version8.0.0 Updaterc4
Drupal ≫ Drupal Version8.0.1
Drupal ≫ Drupal Version8.0.2
Drupal ≫ Drupal Version8.0.3
Drupal ≫ Drupal Version8.0.4
Drupal ≫ Drupal Version8.0.5
Drupal ≫ Drupal Version8.0.6
Drupal ≫ Drupal Version8.1.0
Drupal ≫ Drupal Version8.1.0 Updatebeta1
Drupal ≫ Drupal Version8.1.0 Updatebeta2
Drupal ≫ Drupal Version8.1.0 Updaterc1
Drupal ≫ Drupal Version8.1.1
Drupal ≫ Drupal Version8.1.2
Drupal ≫ Drupal Version8.1.3
Drupal ≫ Drupal Version8.1.4
Drupal ≫ Drupal Version8.1.5
Drupal ≫ Drupal Version8.1.6
Drupal ≫ Drupal Version8.1.7
Drupal ≫ Drupal Version8.1.8
Drupal ≫ Drupal Version8.1.9
Zu dieser CVE wurde keine CISA KEV oder CERT.AT-Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 0.51% 0.655
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
nvd@nist.gov 6.1 2.8 2.7
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
nvd@nist.gov 4.3 8.6 2.9
AV:N/AC:M/Au:N/C:N/I:P/A:N
CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.