Description
Cross-site scripting (XSS) vulnerability in the TinyBox (Simple Splash) module before 7.x-2.2 for Drupal allows remote authenticated users with the "administer tinybox" permission to inject arbitrary web script or HTML via unspecified vectors.
References
- 95153 vdb-entry
- 61078 vdb-entry
- https://drupal.org/node/2031575
- 20130710 [Security-news] SA-CONTRIB-2013-057 - TinyBox - Cross Site Scripting (XSS) mailing-list
- 54091 third-party-advisory
- [oss-security] 20130717 Re: CVE request for Drupal contrib modules mailing-list
- tinybox-unspecified-xss(85600) vdb-entry
- https://drupal.org/node/2038807