Unscored CVE-2012-5705 EUVD-2012-5588GHSA-65mg-2397-hph9

Cross-site scripting (XSS) vulnerability in the settings page (admin/settings/hotblocks) in the Hotblocks module 6.x-1.x before 6.x-1.8 for…

Published Nov 1, 2012 · Updated Sep 17, 2024 · Assigned by mitre

Description

Cross-site scripting (XSS) vulnerability in the settings page (admin/settings/hotblocks) in the Hotblocks module 6.x-1.x before 6.x-1.8 for Drupal allows remote authenticated users with the "administer hotblocks" permission to inject arbitrary web script or HTML via the "block names."

References

[oss-security] 20121004 CVE Request for Drupal Contributed Modules mailing-list
http://drupal.org/node/1732828
http://www.madirish.net/543
http://drupal.org/node/1732946
[oss-security] 20121007 Re: CVE Request for Drupal Contributed Modules mailing-list