CVSS base score
CVSS vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N
What the vulnerability does
Drupal avatar_uploader 7.x-1.0-beta8 contains a reflected cross-site scripting vulnerability that allows unauthenticated attackers to inject malicious scripts by manipulating the file parameter. Attackers can craft URLs with script payloads in the file parameter of avatar_uploader.pages.inc to execute arbitrary JavaScript in victim browsers.
Explanation of Vulnerability in Simple Terms
Avatar Uploader contains a cross-site scripting (XSS) vulnerability that allows attackers to inject malicious scripts. An attacker can craft a malicious input that, when viewed by a site user, executes JavaScript in their browser. This requires user interaction to trigger the vulnerability. The vulnerability affects versions 7.x-1.0-beta8.
What an attacker can do
Inject and execute malicious JavaScript in a user's browser when they view affected content.
Potential impact on your site
Site users' sessions, cookies, or credentials could be compromised if they interact with injected content.
Conditions required to exploit
User must view a page containing the attacker's malicious input; no authentication required.
Key dates
External resources
Related vulnerabilities
