Description
Cross-site scripting (XSS) vulnerability in the Custom Search module 6.x-1.x before 6.x-1.12 and 7.x-1.x before 7.x-1.14 for Drupal allows remote authenticated users with certain permissions to inject arbitrary web script or HTML via the "Label text" field to the results configuration page.
References
- 57373 third-party-advisory
- https://drupal.org/node/2231665
- https://www.drupal.org/node/2231531
- custom-search-drupal-xss(92347) vdb-entry
- 20140402 Drupal Custom Search module XSS mailing-list
- https://www.drupal.org/node/2231533