CVE-2014-8747 Cross-site scripting (XSS) vulnerability in the Drupal Commons module 7.x-3.x before 7.x-3.9 for Drupal allows remote attackers to inject arbitrary web script or HTML via vectors related to content cr...
MediumCVSS 4.3
EPSS 1.3%
- Published
- Updated
- Exploit status
- No public exploit known
Description
Cross-site scripting (XSS) vulnerability in the Drupal Commons module 7.x-3.x before 7.x-3.9 for Drupal allows remote attackers to inject arbitrary web script or HTML via vectors related to content creation and activity stream messages.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| drupal commons | = 7.x-3.3 | No fix listed |
| drupal commons | = 7.x-3.3-rc3 | No fix listed |
| drupal commons | = 7.x-3.3-rc4 | No fix listed |
| drupal commons | = 7.x-3.4 | No fix listed |
| drupal commons | = 7.x-3.4-rc1 | No fix listed |
| drupal commons | = 7.x-3.4-rc2 | No fix listed |
| drupal commons | = 7.x-3.4-rc3 | No fix listed |
| drupal commons | = 7.x-3.5 | No fix listed |
| drupal commons | = 7.x-3.6 | No fix listed |
| drupal commons | = 7.x-3.7 | No fix listed |
| drupal commons | = 7.x-3.8 | No fix listed |
References
- 103288 vdb-entry
- 56861 third-party-advisory
- 65524 vdb-entry
- commons-drupal-activity-xss(91151) vdb-entry
- www.drupal.org patch
- www.drupal.org vendor-advisory