Drupal Views Builk Operations (VBO) module 6.x-1.0 through 6.x-1.10 does not properly escape the vocabulary help when the vocabulary has had user tagging enabled and the "Modify node taxonomy terms" action is used. A remote attacker could provide a specially-crafted URL that could lead to cross-site scripting (XSS) attack.
References
| Link | Resource |
|---|---|
| https://access.redhat.com/security/cve/cve-2011-3373 | Broken Link |
| https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2011-3373 | Issue Tracking Third Party Advisory |
| https://www.openwall.com/lists/oss-security/2011/09/22/4 | Mailing List Third Party Advisory |
| https://www.securityfocus.com/bid/49727 | Third Party Advisory VDB Entry |
| https://access.redhat.com/security/cve/cve-2011-3373 | Broken Link |
| https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2011-3373 | Issue Tracking Third Party Advisory |
| https://www.openwall.com/lists/oss-security/2011/09/22/4 | Mailing List Third Party Advisory |
| https://www.securityfocus.com/bid/49727 | Third Party Advisory VDB Entry |
Configurations
History
21 Nov 2024, 01:30
| Type | Values Removed | Values Added |
|---|---|---|
| References | () https://access.redhat.com/security/cve/cve-2011-3373 - Broken Link | |
| References | () https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2011-3373 - Issue Tracking, Third Party Advisory | |
| References | () https://www.openwall.com/lists/oss-security/2011/09/22/4 - Mailing List, Third Party Advisory | |
| References | () https://www.securityfocus.com/bid/49727 - Third Party Advisory, VDB Entry |
Information
Published : 2019-11-25 23:15
Updated : 2024-11-21 01:30
NVD link : CVE-2011-3373
Mitre link : CVE-2011-3373
CVE.ORG link : CVE-2011-3373
JSON object : View
Products Affected
drupal
- views_builk_operations
CWE
CWE-79
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')