CVE-2014-8744: XSS
Published Oct 13, 2014
·Updated
Cross-site scripting (XSS) vulnerability in the Nivo Slider module 7.x-2.x before 7.x-1.11 for Drupal allows remote authenticated users with the "administer nivo slider" permission to inject arbitrary web script or HTML via an image title.
Affected Software
11 affected components
Drupal Nivo Slider=7.x-1.0
Drupal Nivo Slider=7.x-1.1
Drupal Nivo Slider=7.x-1.2
Drupal Nivo Slider=7.x-1.3
Drupal Nivo Slider=7.x-1.4
Drupal Nivo Slider=7.x-1.5
Drupal Nivo Slider=7.x-1.6
Drupal Nivo Slider=7.x-1.7
Drupal Nivo Slider=7.x-1.8
Drupal Nivo Slider=7.x-1.9
Drupal Nivo Slider=7.x-1.10
Remediation
Patch Available
Event History
Oct 13, 2014
CVE Published
via MITRE·06:00 PM
Data Sourced
via MITRE·06:00 PM
Description
Frequently Asked Questions
1
What is the severity of CVE-2014-8744?
CVE-2014-8744 is considered a moderate severity vulnerability due to its potential for cross-site scripting attacks.
2
How do I fix CVE-2014-8744?
To fix CVE-2014-8744, update the Nivo Slider module to version 7.x-1.11 or later.
3
Who is affected by CVE-2014-8744?
CVE-2014-8744 affects remote authenticated users with the 'administer nivo slider' permission in Drupal.
4
What type of vulnerability is CVE-2014-8744?
CVE-2014-8744 is a cross-site scripting (XSS) vulnerability.
5
What can attackers do with CVE-2014-8744?
Attackers can inject arbitrary web scripts or HTML into the Nivo Slider module through manipulated image titles.