CVE-2014-9364: XSS

Published Dec 10, 2014

Updated

Cross-site scripting (XSS) vulnerability in the Unified Login form in the LoginToboggan module 7.x-1.x before 7.x-1.4 for Drupal allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.

Affected Software

8 affected components

Logintoboggan Project Logintoboggan Drupal=7.x-1.0

Logintoboggan Project Logintoboggan Drupal=7.x-1.0-alpha1

Logintoboggan Project Logintoboggan Drupal=7.x-1.0-alpha2

Logintoboggan Project Logintoboggan Drupal=7.x-1.0-alpha3

Logintoboggan Project Logintoboggan Drupal=7.x-1.1

Logintoboggan Project Logintoboggan Drupal=7.x-1.2

Logintoboggan Project Logintoboggan Drupal=7.x-1.3

Logintoboggan Project Logintoboggan Drupal=7.x-1.x-x-dev

Remediation

Patch Available

https://www.drupal.org/node/2299467

Event History

Dec 10, 2014

CVE Published

via MITRE·08:00 PM

Data Sourced

via MITRE·08:00 PM

Description

Frequently Asked Questions

What is the severity of CVE-2014-9364?

CVE-2014-9364 has a medium severity rating due to its potential to allow XSS attacks through the Unified Login form.

How do I fix CVE-2014-9364?

To fix CVE-2014-9364, you should upgrade the LoginToboggan module to version 7.x-1.4 or later.

Who is affected by CVE-2014-9364?

CVE-2014-9364 affects users of the LoginToboggan module version 7.x-1.0 through 7.x-1.3 for Drupal.

What type of vulnerability is CVE-2014-9364?

CVE-2014-9364 is a cross-site scripting (XSS) vulnerability that allows remote attackers to inject web scripts or HTML.

What can be exploited in CVE-2014-9364?

CVE-2014-9364 can be exploited via unspecified vectors in the Unified Login form, allowing unauthorized script injection.