CVEvulnerability
CVE-2015-3390
3.5 LOW
Official page ↗
- Status
- Modified
- Published
- 2015-04-21
- Last modified
- 2026-06-17
- Assigner
- [email protected]
- CVSS 2.0 ([email protected])
- 3.5 LOW — AV:N/AC:M/Au:S/C:N/I:P/A:N
- Weaknesses
- CWE-79
Description
Cross-site scripting (XSS) vulnerability in the Facebook Album Fetcher module for Drupal allows remote authenticated users with the "access administration pages" permission to inject arbitrary web script or HTML via unspecified vectors.
Affected configurations
• facebook album fetcher project facebook album fetcher 7.x-1.x-dev
Related
Weakness · CWE (1)
- CWE-79 Improper Neutralization of Input During Web Page Generation weakness
References
- http://www.openwall.com/lists/oss-security/2015/02/05/16 www.openwall.com
- http://www.securityfocus.com/bid/72570 www.securityfocus.com
- https://exchange.xforce.ibmcloud.com/vulnerabilities/100655 exchange.xforce.ibmcloud.com
- https://www.drupal.org/node/2420161 Patch, Vendor Advisory
- http://www.openwall.com/lists/oss-security/2015/02/05/16 www.openwall.com
- http://www.securityfocus.com/bid/72570 www.securityfocus.com
- https://exchange.xforce.ibmcloud.com/vulnerabilities/100655 exchange.xforce.ibmcloud.com
- https://www.drupal.org/node/2420161 Patch, Vendor Advisory