CVE-2012-0914

Drupal <6.x-3.10, <7.x-3.0 - XSS

Title source: llm

Description

Cross-site scripting (XSS) vulnerability in display_renderers/panels_renderer_editor.class.php in the admin view in the Panels module 6.x-2.x before 6.x-3.10 and 7.x-3.x before 7.x-3.0 for Drupal allows remote authenticated users with certain privileges to inject arbitrary web script or HTML via the Region title.

References (10)

[Patch, Vendor Advisory] http://drupal.org/node/1409436

[Patch] http://drupal.org/node/1409446

[Patch] http://drupal.org/node/1409448

[Vendor Advisory] http://secunia.com/advisories/47649

[Patch] http://www.madirish.net/content/drupal-panels-6x-39-xss-vulnerability

[Third Party Advisory, VDB Entry] https://exchange.xforce.ibmcloud.com/vulnerabilities/72549

[Patch] http://drupalcode.org/project/panels.git/commit/2066d59

[Patch] http://drupalcode.org/project/panels.git/commit/d844942

[Third Party Advisory, VDB Entry] http://www.securityfocus.com/bid/51568

[Third Party Advisory, VDB Entry] http://osvdb.org/78367

Scores

EPSS 0.0078

EPSS Percentile 73.4%

Classification

CWE

CWE-79

Status published

Affected Products (23)

earl_miles/panels

earl_miles/panels

earl_miles/panels

earl_miles/panels

earl_miles/panels

earl_miles/panels

earl_miles/panels

earl_miles/panels

earl_miles/panels

earl_miles/panels

earl_miles/panels

earl_miles/panels

earl_miles/panels

earl_miles/panels

earl_miles/panels

... and 8 more

Timeline

Published Jan 24, 2012

Tracked Since Feb 18, 2026