Unscored CVE-2014-5169 EUVD-2014-5067GHSA-g6ch-jp62-x9c6

Cross-site scripting (XSS) vulnerability in the Date module before 7.x-2.8 for Drupal allows remote authenticated users with the permission…

Published Oct 20, 2014 · Updated Aug 6, 2024 · Assigned by mitre

Description

Cross-site scripting (XSS) vulnerability in the Date module before 7.x-2.8 for Drupal allows remote authenticated users with the permission to create a date field to inject arbitrary web script or HTML via the date field title.

References

[oss-security] 20140730 CVE request for Drupal contributed modules mailing-list
68974 vdb-entry
https://www.drupal.org/node/2312609
https://www.drupal.org/node/2311887
[oss-security] 20140731 Re: CVE request for Drupal contributed modules mailing-list