CVSS base score
CVSS vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N
What the vulnerability does
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Drupal Flag allows Cross-Site Scripting (XSS).This issue affects Flag: from 7.X-3.0 through 7.X-3.9.
Explanation of Vulnerability in Simple Terms
The Flag module for Drupal contains a cross-site scripting (XSS) vulnerability in versions 7.x-3.0 through 7.x-3.9. An attacker with low-level site access can inject malicious scripts that execute in other users' browsers when they interact with flagged content. The vulnerability requires user interaction to trigger. Update to a version newer than 7.x-3.9.
What an attacker can do
Inject malicious scripts that run in other users' browsers when they view flagged content.
Potential impact on your site
Authenticated attackers can steal session cookies, redirect users, or deface content visible to other site users.
Conditions required to exploit
Low-level site access (authenticated user) and the victim must view a page containing the malicious flag.
Key dates
External resources
Related vulnerabilities
