CVE-2012-1632: XSS
Cross-site scripting (XSS) vulnerability in passwordpolicy.admin.inc in the Password Policy module before 6.x-1.4 and 7.x-1.0 beta3 for Drupal allows remote authenticated users with administer policies permissions to inject arbitrary web script or HTML via the name parameter.
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2012-1632?
The severity of CVE-2012-1632 is classified as moderate due to its potential to allow cross-site scripting attacks.
How do I fix CVE-2012-1632?
To fix CVE-2012-1632, update the Password Policy module to version 6.x-1.4 or later for Drupal 6, or 7.x-1.0 beta4 or later for Drupal 7.
What versions of the Password Policy module are affected by CVE-2012-1632?
CVE-2012-1632 affects Password Policy module versions prior to 6.x-1.4 and 7.x-1.0 beta3.
Who can exploit CVE-2012-1632?
CVE-2012-1632 can be exploited by remote authenticated users who have administer policies permissions.
What type of vulnerability is CVE-2012-1632?
CVE-2012-1632 is a cross-site scripting (XSS) vulnerability that allows the injection of arbitrary web script or HTML.