Vulnerability CVE-2014-9346
Published: 2014-12-08

Description:
Multiple cross-site scripting (XSS) vulnerabilities in the Hierarchical Select module 6.x-3.x before 6.x-3.9 for Drupal allow remote authenticated users with certain permissions to inject arbitrary web script or HTML via vectors related to the (1) taxonomy term title for instances with Save term lineage enabled or (2) entity type fields.

CVSS2 => (AV:N/AC:M/Au:S/C:N/I:P/A:N)

CVSS Base Score
Impact Subscore
Exploitability Subscore
3.5/10
2.9/10
6.8/10
Exploit range
Attack complexity
Authentication
Remote
Medium
Single time
Confidentiality impact
Integrity impact
Availability impact
None
Partial
None
Affected software
Hierarchial select project -> Hierarchical select 

 References:
https://exchange.xforce.ibmcloud.com/vulnerabilities/99136
https://www.drupal.org/node/2385933
https://www.drupal.org/node/2386615
Copyright 2024, cxsecurity.com

 

Back to Top