CVE-2016-3144

MEDIUM

Block Class module 7.x-2.x < 7.x-2.2 - Authenticated Cross-Site Scripting via Class Name

Title source: llm

Description

Cross-site scripting (XSS) vulnerability in the Block Class module 7.x-2.x before 7.x-2.2 for Drupal allows remote authenticated users with the "Administer block classes" permission to inject arbitrary web script or HTML via a class name.

References (5)

Core 5

Core References

Patch, Vendor Advisory x_refsource_misc

https://www.drupal.org/node/2636502

Mailing List, Third Party Advisory vendor-advisory x_refsource_fedora

http://lists.fedoraproject.org/pipermail/package-announce/2016-April/182953.html

Patch x_refsource_confirm

https://www.drupal.org/node/2636498

Mailing List, Third Party Advisory vendor-advisory x_refsource_fedora

http://lists.fedoraproject.org/pipermail/package-announce/2016-April/182886.html

Mailing List, Third Party Advisory vendor-advisory x_refsource_fedora

http://lists.fedoraproject.org/pipermail/package-announce/2016-April/182535.html

Scores

CVSS v3 5.4

EPSS 0.0112

EPSS Percentile 62.7%

Attack Vector NETWORK

CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Details

CWE

CWE-79

Status published

Products (3)

fedoraproject/fedora 24

fourkitchens/block_class 7.x-2.0

fourkitchens/block_class 7.x-2.1

Published Apr 15, 2016

Tracked Since Feb 18, 2026