CVE-2012-1639: XSS
Multiple cross-site scripting (XSS) vulnerabilities in product/commerceproduct.module in the Drupal Commerce module for Drupal before 7.x-1.2 allow remote authenticated users to inject arbitrary web script or HTML via the (1) sku or (2) title parameters.
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What are the vulnerabilities associated with CVE-2012-1639?
CVE-2012-1639 describes multiple cross-site scripting (XSS) vulnerabilities in the Drupal Commerce module that can be exploited by remote authenticated users.
Which versions of Drupal Commerce are affected by CVE-2012-1639?
CVE-2012-1639 affects Drupal Commerce versions prior to 7.x-1.2.
How can I mitigate the risks from CVE-2012-1639?
To mitigate CVE-2012-1639, upgrade the Drupal Commerce module to version 7.x-1.2 or later.
Can unprivileged users exploit CVE-2012-1639?
No, CVE-2012-1639 can only be exploited by remote authenticated users.
What parameters are involved in the CVE-2012-1639 exploits?
The parameters involved in the CVE-2012-1639 exploits are 'sku' and 'title' within the product/commerce_product.module.