CVE-2014-8743

Drupal Maestro 7.x-1.x < 7.x-1.4 - Authenticated Cross-Site Scripting via Role or Organic Group Name

Title source: llm
STIX 2.1

Description

Multiple cross-site scripting (XSS) vulnerabilities in the Maestro module 7.x-1.x before 7.x-1.4 for Drupal allow remote authenticated users with certain permissions to inject arbitrary web script or HTML via a (1) Role or (2) Organic Group name.

References (5)

Core 5
Core References
Third Party Advisory third-party-advisory x_refsource_secunia
http://secunia.com/advisories/56790
Vendor Advisory x_refsource_misc
https://drupal.org/node/2200453
Third Party Advisory, VDB Entry vdb-entry x_refsource_xf
https://exchange.xforce.ibmcloud.com/vulnerabilities/91274
Third Party Advisory, VDB Entry vdb-entry x_refsource_bid
http://www.securityfocus.com/bid/65677
Patch x_refsource_confirm
https://www.drupal.org/node/2013653

Scores

EPSS 0.0018
EPSS Percentile 38.5%

Details

CWE
CWE-79
Status published
Products (5)
drupal/maestro 7.x-1.0 (5 CPE variants)
drupal/maestro 7.x-1.1
drupal/maestro 7.x-1.2
drupal/maestro 7.x-1.3
drupal/maestro 7.x-1.x-dev
Published Oct 13, 2014
Tracked Since Feb 18, 2026