CVE-2010-0697

CVE-2010-0697

EPSS 1.0%

Cross-site scripting (XSS) vulnerability in the iTweak Upload module 6.x-1.x before 6.x-1.2 and 6.x-2.x before 6.x-2.3 for Drupal allows remote authenticated users, with create content and upload file permissions, to inject arbitrary web script or HTML via the file name of an uploaded file.

Produtos afetados

Quer saber se a sua infraestrutura está exposta a isto?

Falar com a TrueHacking →

Referências

http://drupal.org/node/711072 http://drupal.org/node/711074 http://drupal.org/node/717214 http://osvdb.org/62405 http://secunia.com/advisories/38633 https://exchange.xforce.ibmcloud.com/vulnerabilities/56351 http://www.securityfocus.com/bid/38292