Unscored CVE-2013-5964 EUVD-2013-5794GHSA-7hf9-xmq4-prrq

Cross-site scripting (XSS) vulnerability in the administration page in the Flag module 7.x-3.x before 7.x-3.1 for Drupal allows remote auth…

Published Sep 30, 2013 · Updated Sep 17, 2024 · Assigned by mitre

Description

Cross-site scripting (XSS) vulnerability in the administration page in the Flag module 7.x-3.x before 7.x-3.1 for Drupal allows remote authenticated users with the "Administer flags" permission to inject arbitrary web script or HTML via the flag title.

References

https://drupal.org/node/2075287
20130828 [Security-news] SA-CONTRIB-2013-071 - Flag - Cross Site Scripting mailing-list
96750 vdb-entry
20130828 Drupal Node View Permissions module and Flag module Vulnerabilities mailing-list
https://drupal.org/node/2076221