XSS in Drupac Touch

CVE-2014-4303

Multiple cross-site scripting (XSS) vulnerabilities in the Touch theme 7.x-1.x before 7.x-1.9 for Drupal allow remote authenticated users with the Administer themes permission to inject arbitrary web script or HTML via vectors related to the (1) Twitter and (2) Facebook username settings.

Vulnerability class: XSS (Cross-Site Scripting)

EPSS: 0.013 (66.7th percentile) — read the EPSS interpretation.

Affected products

  • Drupac Touch — versions 7.x-1.0, 7.x-1.1, 7.x-1.2
  • N/a — versions n/a

Weakness classification (CWE)

References

  • cve@mitre.org (VDB Entry, Third Party Advisory, vdb-entry, x_refsource_BID)
  • cve@mitre.org (Patch, Third Party Advisory, x_refsource_MISC)
  • cve@mitre.org (Permissions Required, x_refsource_SECUNIA, Third Party Advisory, third-party-advisory)
  • cve@mitre.org (x_refsource_CONFIRM, Patch, Third Party Advisory)