Description
Cross-site scripting (XSS) vulnerability in the "3 slide gallery" in the Elegant Theme module 7.x-1.x before 7.x-1.1 for Drupal allows remote authenticated users with the "administer themes" permission to inject arbitrary web script or HTML via a slide URL.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
n/a n/a
n/aaffected
References
- http://drupal.org/node/1733056 ↗
- http://www.openwall.com/lists/oss-security/2012/10/04/6 ↗
- http://drupal.org/node/1722880 ↗
- http://drupalcode.org/project/elegant_theme.git/commitdiff/bdea7b1 ↗
- http://secunia.com/advisories/50273 ↗
- http://www.securityfocus.com/bid/55043 ↗
- http://www.openwall.com/lists/oss-security/2012/10/07/1 ↗