CVEvulnerability
CVE-2014-4303
2.1 LOW
Official page ↗
- Status
- Modified
- Published
- 2014-06-18
- Last modified
- 2026-06-17
- Assigner
- [email protected]
- CVSS 2.0 ([email protected])
- 2.1 LOW — AV:N/AC:H/Au:S/C:N/I:P/A:N
- Weaknesses
- CWE-79
Description
Multiple cross-site scripting (XSS) vulnerabilities in the Touch theme 7.x-1.x before 7.x-1.9 for Drupal allow remote authenticated users with the Administer themes permission to inject arbitrary web script or HTML via vectors related to the (1) Twitter and (2) Facebook username settings.
Affected configurations
• drupac touch 7.x-1.0
• drupac touch 7.x-1.1
• drupac touch 7.x-1.2
• drupac touch 7.x-1.3
• drupac touch 7.x-1.4
• drupac touch 7.x-1.5
• drupac touch 7.x-1.6
• drupac touch 7.x-1.7
• drupac touch 7.x-1.8
Related
Weakness · CWE (1)
- CWE-79 Improper Neutralization of Input During Web Page Generation weakness
References
- http://secunia.com/advisories/58828 Permissions Required, Third Party Advisory
- http://www.securityfocus.com/bid/68045 Third Party Advisory, VDB Entry
- https://drupal.org/node/2269483 Patch, Third Party Advisory
- https://drupal.org/node/2284415 Patch, Third Party Advisory
- http://secunia.com/advisories/58828 Permissions Required, Third Party Advisory
- http://www.securityfocus.com/bid/68045 Third Party Advisory, VDB Entry
- https://drupal.org/node/2269483 Patch, Third Party Advisory
- https://drupal.org/node/2284415 Patch, Third Party Advisory