CVE-2013-4274: XSS
Cross-site scripting (XSS) vulnerability in the passwordpolicyadminview function in passwordpolicy.admin.inc in the Password Policy module 6.x-1.x before 6.x-1.6 and 7.x-1.x before 7.x-1.5 for Drupal allows remote authenticated users with the "Administer policies" permission to inject arbitrary web script or HTML via the "Password Expiration Warning" field to the admin/config/people/passwordpolicy/add page.
Affected Software
Remediation
Patch Available
Patch Available
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2013-4274?
CVE-2013-4274 is classified as a moderate severity vulnerability due to the possibility of cross-site scripting (XSS).
How do I fix CVE-2013-4274?
To fix CVE-2013-4274, you should upgrade the Password Policy module to versions 6.x-1.6 or 7.x-1.5 or later.
Who is affected by CVE-2013-4274?
CVE-2013-4274 affects users with the 'Administer policies' permission on specific outdated versions of the Password Policy module for Drupal.
What type of attack does CVE-2013-4274 allow?
CVE-2013-4274 allows remote authenticated users to perform cross-site scripting (XSS) attacks.
Is CVE-2013-4274 still a threat?
CVE-2013-4274 is no longer a threat if the affected versions of the Password Policy module have been updated to the patched releases.