CVE-2014-9498

Severity Score

3.5

*CVSS v2

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

*Multiple Sources

Exploited in Wild

*KEV

Decision

*SSVC

Descriptions

Cross-site scripting (XSS) vulnerability in the Webform Invitation module 7.x-1.x before 7.x-1.3 and 7.x-2.x before 7.x-2.4 for Drupal allows remote authenticated users with the Webform: Create new content, Webform: Edit own content, or Webform: Edit any content permission to inject arbitrary web script or HTML via a node title.

Vulnerabilidad de XSS en el módulo Webform Invitation 7.x-1.x anterior a 7.x-1.3 y 7.x-2.x anterior a 7.x-2.4 para Drupal permite a usuarios remotos autenticados el permiso Webform: Crear contenido nuevo, Webform: Editar contenido propio o Webform: Editar cualquier contenido inyectar secuencias de comandos web o HTML arbitrarios a través de un título de nodo.

*Credits: N/A

CVSS Scores

NISTv2 3.5

Attack Vector

Network

Attack Complexity

Medium

Authentication

Single

Confidentiality

None

Integrity

Partial

Availability

None

* Common Vulnerability Scoring System

SSVC

Decision:-

Exploitation

Automatable

Tech. Impact

* Organization's Worst-case Scenario

Timeline

2015-01-03 CVE Reserved
2015-01-09 CVE Published
2023-03-07 EPSS Updated
2024-08-06 CVE Updated
---------- Exploited in Wild
---------- KEV Due Date
---------- First Exploit

CWE

CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CAPEC

References (5)

URL	Tag	Source
http://www.openwall.com/lists/oss-security/2015/01/03/2	Mailing List
http://www.openwall.com/lists/oss-security/2015/01/04/6	Mailing List

URL	Date	SRC

URL	Date	SRC
https://www.drupal.org/node/2386011	2015-01-12
https://www.drupal.org/node/2386013	2015-01-12

URL	Date	SRC
https://www.drupal.org/node/2386387	2015-01-12

Affected Vendors, Products, and Versions

Vendor		Product				Version		Other		Status
Vendor	Product	Version	Other	Status	<-- -->	Vendor	Product	Version	Other	Status
Webform Invitation Project Search vendor "Webform Invitation Project"		Webform Invitation Search vendor "Webform Invitation Project" for product "Webform Invitation"				7.x-1.0 Search vendor "Webform Invitation Project" for product "Webform Invitation" and version "7.x-1.0"		drupal		Affected
Webform Invitation Project Search vendor "Webform Invitation Project"		Webform Invitation Search vendor "Webform Invitation Project" for product "Webform Invitation"				7.x-1.1 Search vendor "Webform Invitation Project" for product "Webform Invitation" and version "7.x-1.1"		drupal		Affected
Webform Invitation Project Search vendor "Webform Invitation Project"		Webform Invitation Search vendor "Webform Invitation Project" for product "Webform Invitation"				7.x-1.2 Search vendor "Webform Invitation Project" for product "Webform Invitation" and version "7.x-1.2"		drupal		Affected
Webform Invitation Project Search vendor "Webform Invitation Project"		Webform Invitation Search vendor "Webform Invitation Project" for product "Webform Invitation"				7.x-2.0 Search vendor "Webform Invitation Project" for product "Webform Invitation" and version "7.x-2.0"		drupal		Affected
Webform Invitation Project Search vendor "Webform Invitation Project"		Webform Invitation Search vendor "Webform Invitation Project" for product "Webform Invitation"				7.x-2.1 Search vendor "Webform Invitation Project" for product "Webform Invitation" and version "7.x-2.1"		drupal		Affected
Webform Invitation Project Search vendor "Webform Invitation Project"		Webform Invitation Search vendor "Webform Invitation Project" for product "Webform Invitation"				7.x-2.2 Search vendor "Webform Invitation Project" for product "Webform Invitation" and version "7.x-2.2"		drupal		Affected
Webform Invitation Project Search vendor "Webform Invitation Project"		Webform Invitation Search vendor "Webform Invitation Project" for product "Webform Invitation"				7.x-2.3 Search vendor "Webform Invitation Project" for product "Webform Invitation" and version "7.x-2.3"		drupal		Affected