CVSS base score
What the vulnerability does
Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal AT Internet SmartTag allows Cross-Site Scripting (XSS).This issue affects AT Internet SmartTag: from 0.0.0 before 1.0.1.
Explanation of Vulnerability in Simple Terms
The AT Internet SmartTag Drupal module contains a cross-site scripting (XSS) vulnerability in versions before 1.0.1. An attacker can inject malicious scripts that execute in the browsers of site visitors or administrators. The vulnerability's exact attack vector and required privileges are not fully documented. Update to version 1.0.1 or later to resolve this issue.
What an attacker can do
Inject malicious scripts that run in visitors' browsers, potentially stealing session tokens or redirecting users.
Potential impact on your site
Visitors and administrators may have their sessions compromised or be redirected to malicious sites without their knowledge.
Conditions required to exploit
Ability to input data into a field processed by the module; exact requirements depend on the vulnerable input vector.
Key dates
External resources
