CVE-2014-4303 Multiple cross-site scripting (XSS) vulnerabilities in the Touch theme 7.x-1.x before 7.x-1.9 for Drupal allow remote authenticated users with the Administer themes permission to inject arbitrary web....
LowCVSS 2.1
EPSS 1.3%
- Published
- Updated
- Exploit status
- No public exploit known
Description
Multiple cross-site scripting (XSS) vulnerabilities in the Touch theme 7.x-1.x before 7.x-1.9 for Drupal allow remote authenticated users with the Administer themes permission to inject arbitrary web script or HTML via vectors related to the (1) Twitter and (2) Facebook username settings.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| drupac touch | = 7.x-1.0 | No fix listed |
| drupac touch | = 7.x-1.1 | No fix listed |
| drupac touch | = 7.x-1.2 | No fix listed |
| drupac touch | = 7.x-1.3 | No fix listed |
| drupac touch | = 7.x-1.4 | No fix listed |
| drupac touch | = 7.x-1.5 | No fix listed |
| drupac touch | = 7.x-1.6 | No fix listed |
| drupac touch | = 7.x-1.7 | No fix listed |
| drupac touch | = 7.x-1.8 | No fix listed |
References
- 58828 permissions-required third-party-advisory
- 68045 third-party-advisory vdb-entry
- drupal.org patch third-party-advisory
- drupal.org patch third-party-advisory