5.4

CVE-2024-13273

Open Social - Moderately critical - Cross Site Scripting, Denial of Service - SA-CONTRIB-2024-037

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal Open Social allows Cross-Site Scripting (XSS).This issue affects Open Social: from 0.0.0 before 12.3.8, from 12.4.0 before 12.4.5, from 13.0.0 before 13.0.0-alpha11.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Getopensocial ≫ Open Social SwPlatform drupal Version < 12.3.8
Getopensocial ≫ Open Social SwPlatform drupal Version >= 12.4.0 < 12.4.5
Getopensocial ≫ Open Social Version 13.0.0 Update alpha1 SwPlatform drupal
Getopensocial ≫ Open Social Version 13.0.0 Update alpha10 SwPlatform drupal
Getopensocial ≫ Open Social Version 13.0.0 Update alpha2 SwPlatform drupal
Getopensocial ≫ Open Social Version 13.0.0 Update alpha3 SwPlatform drupal
Getopensocial ≫ Open Social Version 13.0.0 Update alpha4 SwPlatform drupal
Getopensocial ≫ Open Social Version 13.0.0 Update alpha5 SwPlatform drupal
Getopensocial ≫ Open Social Version 13.0.0 Update alpha6 SwPlatform drupal
Getopensocial ≫ Open Social Version 13.0.0 Update alpha7 SwPlatform drupal
Getopensocial ≫ Open Social Version 13.0.0 Update alpha8 SwPlatform drupal
Getopensocial ≫ Open Social Version 13.0.0 Update alpha9 SwPlatform drupal
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 0.22% 0.123
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
CISA-ADP 5.4 2.3 2.7
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

https://www.drupal.org/sa-contrib-2024-037
Third Party Advisory