CVE-2012-1639

https://notcve.org/view.php?id=CVE-2012-1639

Multiple cross-site scripting (XSS) vulnerabilities in product/commerce_product.module in the Drupal Commerce module for Drupal before 7.x-1.2 allow remote authenticated users to inject arbitrary web script or HTML via the (1) sku or (2) title parameters. Múltiples vulnerabilidades de falsificación de petición en sitios cruzados (CSRF) en el módulo enproduct/commerce_product.module en el módulo Drupal Commerce para Drupal anteriores a v7.x-1.2, permite a atacantes remotos secuestrar la autenticación de los usuarios para inyectar comandos web o html a través de los parámetros (1) sku o (2) title. • http://drupal.org/node/1416824 http://drupalcode.org/project/commerce.git/blobdiff/45bc53875f1675750afe60e709a34c95e3008366..b74cdcd:/modules/product/commerce_product.module http://osvdb.org/78528 http://secunia.com/advisories/47730 http://www.openwall.com/lists/oss-security/2012/04/07/1 http://www.securityfocus.com/bid/51668 https://exchange.xforce.ibmcloud.com/vulnerabilities/72743 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •