CVE-2015-6665: XSS
Published Aug 24, 2015
·Updated
Cross-site scripting (XSS) vulnerability in the Ajax handler in Drupal 7.x before 7.39 and the Ctools module 6.x-1.x before 6.x-1.14 for Drupal allows remote attackers to inject arbitrary web script or HTML via vectors involving a whitelisted HTML element, possibly related to the "a" tag.
Affected Software
78 affected components
fedoraproject fedora=21
fedoraproject fedora=22
fedoraproject fedora=23
Drupal Drupal=7.0
Drupal Drupal=7.0-alpha1
Drupal Drupal=7.0-alpha2
Drupal Drupal=7.0-alpha3
Drupal Drupal=7.0-alpha4
Drupal Drupal=7.0-alpha5
Drupal Drupal=7.0-alpha6
Drupal Drupal=7.0-alpha7
Drupal Drupal=7.0-beta1
Drupal Drupal=7.0-beta2
Drupal Drupal=7.0-beta3
Drupal Drupal=7.0-dev
Drupal Drupal=7.0-rc1
Drupal Drupal=7.0-rc2
Drupal Drupal=7.0-rc3
Drupal Drupal=7.0-rc4
Drupal Drupal=7.1
Drupal Drupal=7.2
Drupal Drupal=7.3
Drupal Drupal=7.4
Drupal Drupal=7.5
Drupal Drupal=7.6
Drupal Drupal=7.7
Drupal Drupal=7.8
Drupal Drupal=7.9
Drupal Drupal=7.10
Drupal Drupal=7.11
Drupal Drupal=7.12
Drupal Drupal=7.13
Drupal Drupal=7.14
Drupal Drupal=7.15
Drupal Drupal=7.16
Drupal Drupal=7.17
Drupal Drupal=7.18
Drupal Drupal=7.19
Drupal Drupal=7.20
Drupal Drupal=7.21
Drupal Drupal=7.22
Drupal Drupal=7.23
Drupal Drupal=7.24
Drupal Drupal=7.25
Drupal Drupal=7.26
Drupal Drupal=7.27
Drupal Drupal=7.28
Drupal Drupal=7.29
Drupal Drupal=7.30
Drupal Drupal=7.33
Drupal Drupal=7.34
Drupal Drupal=7.35
Drupal Drupal=7.36
Drupal Drupal=7.37
Drupal Drupal=7.38
Drupal Drupal=7.x-dev
Chaos Tool Suite Project Ctools Drupal=6.x-1.0
Chaos Tool Suite Project Ctools Drupal=6.x-1.0-alpha1
Chaos Tool Suite Project Ctools Drupal=6.x-1.0-alpha2
Chaos Tool Suite Project Ctools Drupal=6.x-1.0-alpha3
Chaos Tool Suite Project Ctools Drupal=6.x-1.0-beta1
Chaos Tool Suite Project Ctools Drupal=6.x-1.0-beta2
Chaos Tool Suite Project Ctools Drupal=6.x-1.0-beta3
Chaos Tool Suite Project Ctools Drupal=6.x-1.0-beta4
Chaos Tool Suite Project Ctools Drupal=6.x-1.0-rc1
Chaos Tool Suite Project Ctools Drupal=6.x-1.1
Chaos Tool Suite Project Ctools Drupal=6.x-1.2
Chaos Tool Suite Project Ctools Drupal=6.x-1.3
Chaos Tool Suite Project Ctools Drupal=6.x-1.4
Chaos Tool Suite Project Ctools Drupal=6.x-1.5
Chaos Tool Suite Project Ctools Drupal=6.x-1.6
Chaos Tool Suite Project Ctools Drupal=6.x-1.7
Chaos Tool Suite Project Ctools Drupal=6.x-1.8
Chaos Tool Suite Project Ctools Drupal=6.x-1.9
Chaos Tool Suite Project Ctools Drupal=6.x-1.11
Chaos Tool Suite Project Ctools Drupal=6.x-1.12
Chaos Tool Suite Project Ctools Drupal=6.x-1.13
Chaos Tool Suite Project Ctools Drupal=6.x-1.x-dev
Remediation
Patch Available
Patch Available
Patch Available
Event History
Aug 24, 2015
CVE Published
via MITRE·02:00 PM
Data Sourced
via MITRE·02:00 PM
Description
Frequently Asked Questions
1
What is the severity of CVE-2015-6665?
CVE-2015-6665 is classified as a high-severity cross-site scripting (XSS) vulnerability.
2
How do I fix CVE-2015-6665?
To fix CVE-2015-6665, update Drupal to version 7.39 or higher and Ctools module to 6.x-1.14 or higher.
3
What types of attacks are possible with CVE-2015-6665?
CVE-2015-6665 allows remote attackers to inject arbitrary web scripts or HTML, facilitating XSS attacks.
4
Which versions of Drupal are affected by CVE-2015-6665?
CVE-2015-6665 affects Drupal 7.x before version 7.39.
5
Which versions of Ctools are affected by CVE-2015-6665?
CVE-2015-6665 affects the Ctools module 6.x-1.x before version 6.x-1.14.