CVE-2013-1887

Views - XSS

Title source: rule

Description

Multiple cross-site scripting (XSS) vulnerabilities in the Views module 7.x-3.x before 7.x-3.6 for Drupal allow remote authenticated users with certain permissions to inject arbitrary web script or HTML via certain view configuration fields.

References (10)

[Patch] http://drupal.org/node/1948354

[Patch, Vendor Advisory] http://drupal.org/node/1948358

[Various Sources] http://drupalcode.org/project/views.git/commitdiff/ddf8181bd13f69ffbeeee14ae72168418785d7ac

[Exploit, Third Party Advisory] http://packetstormsecurity.com/files/120892/Drupal-Views-7.x-Cross-Site-Scripting.html

[Mailing List] http://seclists.org/fulldisclosure/2013/Mar/193

[Vendor Advisory] http://secunia.com/advisories/51540

[Third Party Advisory, VDB Entry] http://www.osvdb.org/91576

[Third Party Advisory, VDB Entry] http://www.securityfocus.com/bid/58621

[Mailing List] http://www.openwall.com/lists/oss-security/2013/03/22/8

[Mailing List] http://www.openwall.com/lists/oss-security/2013/03/25/4

Scores

EPSS 0.0028

EPSS Percentile 51.3%

Details

CWE

CWE-79

Status published

Products (14)

views_project/views

... and 4 more

Published Mar 27, 2013

Tracked Since Feb 18, 2026