CVEvulnerability

CVE-2014-8765

4.3 MEDIUM Published 2014-10-14 Modified 2026-06-17 Official page ↗
Status
Modified
Published
2014-10-14
Last modified
2026-06-17
Assigner
[email protected]
CVSS 2.0 ([email protected])
4.3 MEDIUM — AV:N/AC:M/Au:N/C:N/I:P/A:N
Weaknesses
CWE-79

Description

Multiple cross-site scripting (XSS) vulnerabilities in the Project Issue File Review module (PIFR) module 6.x-2.x before 6.x-2.17 for Drupal allow (1) remote attackers to inject arbitrary web script or HTML via a crafted patch, which triggers a PIFR client to test the patch and return the results to the PIFR_Server test results page or (2) remote authenticated users with the "manage PIFR environments" permission to inject arbitrary web script or HTML via vectors involving a PIFR_Server administrative page.

Affected configurations

• drupal project issue file review (<= 6.x-2.16) • drupal project issue file review 6.x-2.00 • drupal project issue file review 6.x-2.01 • drupal project issue file review 6.x-2.02 • drupal project issue file review 6.x-2.03 • drupal project issue file review 6.x-2.04 • drupal project issue file review 6.x-2.05 • drupal project issue file review 6.x-2.06 • drupal project issue file review 6.x-2.07 • drupal project issue file review 6.x-2.08 • drupal project issue file review 6.x-2.10 • drupal project issue file review 6.x-2.12 • drupal project issue file review 6.x-2.13 • drupal project issue file review 6.x-2.14 • drupal project issue file review 6.x-2.15

Related

Weakness · CWE (1)

  • CWE-79 Improper Neutralization of Input During Web Page Generation weakness

References