CVE-2012-1660: XSS
Multiple cross-site scripting (XSS) vulnerabilities in components/select.inc in the Webform module 6.x-3.x before 6.x-3.17 and 7.x-3.x before 7.x-3.17 for Drupal, when the "Select (or other)" module is enabled, allow remote authenticated users with the create webform content permission to inject arbitrary web script or HTML via vectors related to (1) checkboxes or (2) radios.
Affected Software
Remediation
Patch Available
Patch Available
Patch Available
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2012-1660?
The severity of CVE-2012-1660 is rated as Medium due to the risk of cross-site scripting attacks.
How do I fix CVE-2012-1660?
To fix CVE-2012-1660, upgrade the Webform module to version 6.x-3.17 or 7.x-3.17 or later.
Which versions of Webform are affected by CVE-2012-1660?
CVE-2012-1660 affects Webform module versions 6.x-3.0 to 6.x-3.16 and 7.x-3.0 to 7.x-3.16.
What types of vulnerabilities does CVE-2012-1660 include?
CVE-2012-1660 includes multiple cross-site scripting (XSS) vulnerabilities.
Who is at risk from CVE-2012-1660?
Remote authenticated users with the create webform content permission are at risk from CVE-2012-1660.