Description
Cross-site scripting (XSS) vulnerability in the Chaos tool suite (aka CTools) module 7.x-1.x before 7.x-1.0 for Drupal allows remote authenticated users with the post comments permission to inject arbitrary web script or HTML via a user signature.
References
- 48616 third-party-advisory
- http://drupalcode.org/project/ctools.git/commit/755b3c4
- [oss-security] 20120406 CVE's for Drupal Contrib 2012 001 through 057 (67 new CVE assignments) mailing-list
- 52794 vdb-entry
- 80679 vdb-entry
- http://drupal.org/node/1507466
- drupal-chaos-unspecified-xss(74481) vdb-entry
- http://drupal.org/node/1507412