Description
Cross-site scripting (XSS) vulnerability in the 3 slide gallery in page--front.tpl.php in the Business theme before 7.x-1.8 for Drupal allows remote authenticated users with the administer themes permission to inject arbitrary web script or HTML via unspecified vectors.
References
- 52424 third-party-advisory
- 58216 vdb-entry
- http://drupal.org/node/1929496
- 90685 vdb-entry
- http://drupalcode.org/project/business.git/commitdiff/02f081f
- business-3slidegallery-xss(82460) vdb-entry
- [oss-security] 20130227 Re: CVE Request for Drupal Contributed Modules mailing-list
- http://drupal.org/node/1723246