vulnerability: Quick Edit Module up to 7.x-1.2 on Drupal cross site scripting : 9/1/2015 5:08:58 AM

Group Chat & IM for Teams

Communicate with co-workers in real time. Used by Netflix, Dropbox & Salesforce. $0/unlimited users. Get started >>

From our sponsors

Vulnerability Advisories

Vulnerabilities of scip VulDB

Quick Edit Module up to 7.x-1.2 on Drupal cross site scripting
8/30/2015 7:00:00 PM

General

scipID: 77514
Affected: Quick Edit Module up to 7.x-1.2
Published: 08/31/2015
Risk: problematic

Created: 09/01/2015
Entry: 65.8% complete

Summary

A vulnerability was found in Quick Edit Module up to 7.x-1.2 on Drupal. It has been classified as problematic. Affected is an unknown function. The manipulation with an unknown input leads to a cross site scripting vulnerability. This is going to have an impact on integrity. CVE summarizes:

Multiple cross-site scripting (XSS) vulnerabilities in the Quick Edit module 7.x-1.x before 7.x-1.2 for Drupal allow remote authenticated users with certain permissions to inject arbitrary web script or HTML via an (1) entity title, related to in-place editing, or a (2) node title.

The weakness was shared 08/31/2015. This vulnerability is traded as CVE-2015-6753. The exploitability is told to be easy. It is possible to launch the attack remotely. The technical details are unknown and an exploit is not available.

Upgrading to version 7.x-1.3 eliminates this vulnerability.

CVSS

Base Score: 4.0 (CVSS2#AV:N/AC:L/Au:S/C:N/I:P/A:N) [?]
Temp Score: 3.5 (CVSS2#E:ND/RL:OF/RC:ND) [?]

CPE

Exploiting

Class: Cross site scripting
Local: No
Remote: Yes

Availability: No

Countermeasures

Recommended: Upgrade
Status: Official fix
0-Day Time: 0 days since found

Upgrade: Quick Edit Module 7.x-1.3

Timeline

08/31/2015 | Advisory disclosed
09/01/2015 | VulDB entry created
09/01/2015 | VulDB entry updated

Sources

CVE: CVE-2015-6753 (mitre.org) (nvd.nist.org) (cvedetails.com)

You are receiving this email because you subscribed to this feed at feedmyinbox.com

If you no longer wish to receive these emails, you can unsubscribe from this feed, or manage all your subscriptions