CVE-2012-2725: XSS
First published: Wed Jun 27 2012(Updated: )
classes/Filter/WhitelistedExternalFilter.php in the Authoring HTML module 6.x-1.x before 6.x-1.1 for Drupal does not properly validate sources with the host white list, which allows remote authenticated users to bypass intended access restrictions and conduct cross-site scripting (XSS) attacks.
Credit: secalert@redhat.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Authoring Html 6.x-1.0 | ||
| Drupal Drupal |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- http://drupal.org/node/1619086
- http://drupal.org/node/1619852
- http://drupalcode.org/project/authoring_html.git/commitdiff/ceae1ab
- http://secunia.com/advisories/49387
- http://www.openwall.com/lists/oss-security/2012/06/14/3
- http://www.osvdb.org/82739
- https://exchange.xforce.ibmcloud.com/vulnerabilities/76127
Frequently Asked Questions
What is the severity of CVE-2012-2725?
CVE-2012-2725 is classified as a moderate severity vulnerability that can lead to cross-site scripting (XSS) attacks.
How do I fix CVE-2012-2725?
To fix CVE-2012-2725, you should upgrade the Authoring HTML module to version 6.x-1.1 or later.
Who is affected by CVE-2012-2725?
CVE-2012-2725 affects users of Drupal with the Authoring HTML module version 6.x-1.0 before the update to 6.x-1.1.
What type of attack can CVE-2012-2725 allow?
CVE-2012-2725 can allow remote authenticated users to conduct cross-site scripting (XSS) attacks.
How does CVE-2012-2725 exploit validation failures?
CVE-2012-2725 exploits validation failures by bypassing intended access restrictions due to improper host white list validation.
- agent/author
- agent/description
- agent/event
- agent/first-publish-date
- agent/last-modified-date
- agent/references
- agent/remedy
- agent/severity
- agent/softwarecombine
- agent/tags
- agent/type
- agent/weakness
- collector/nvd-index
- vendor/authoring html
- canonical/authoring html 6.x-1.0
- vendor/drupal
- canonical/drupal drupal