CVE-2012-2717
Multiple cross-site scripting (XSS) vulnerabilities in the Mobile Tools module 6.x-2.x before 6.x-2.3 for Drupal allow remote attackers to inject arbitrary web script or HTML via the (1) Mobile URL field or (2) Desktop URL field to the General…
Does this matter?
Lower severity and a low EPSS score (2.46%). Track it; it rarely justifies an emergency change on its own.
Description
Multiple cross-site scripting (XSS) vulnerabilities in the Mobile Tools module 6.x-2.x before 6.x-2.3 for Drupal allow remote attackers to inject arbitrary web script or HTML via the (1) Mobile URL field or (2) Desktop URL field to the General configuration page, or the (3) message to the Mobile Tools block message options.
- CVSS 2.0
- 4.3 MEDIUMAV:N/AC:M/Au:N/C:N/I:P/A:N
- EPSS
- 2.46% probability · 84th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-79
- Affected
- mathew winstone/mobile tools
- Source
- secalert@redhat.com
References
- http://drupal.org/node/1169008Patch
- http://drupal.org/node/1608828Patch, Vendor Advisory
- http://drupalcode.org/project/mobile_tools.git/commitdiff/614b0fcExploit, Patch
- http://osvdb.org/82410
- http://secunia.com/advisories/49318Vendor Advisory
- http://www.madirish.net/content/drupal-mobile-tools-6x-23-xss
- http://www.openwall.com/lists/oss-security/2012/06/14/3
- http://www.securityfocus.com/bid/53734Patch
- https://exchange.xforce.ibmcloud.com/vulnerabilities/76002
- http://drupal.org/node/1169008Patch
- http://drupal.org/node/1608828Patch, Vendor Advisory
- http://drupalcode.org/project/mobile_tools.git/commitdiff/614b0fcExploit, Patch
- http://osvdb.org/82410
- http://secunia.com/advisories/49318Vendor Advisory
- http://www.madirish.net/content/drupal-mobile-tools-6x-23-xss
- http://www.openwall.com/lists/oss-security/2012/06/14/3
- http://www.securityfocus.com/bid/53734Patch
- https://exchange.xforce.ibmcloud.com/vulnerabilities/76002
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.