CVSS base score
What the vulnerability does
Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal AT Internet Piano Analytics allows Cross-Site Scripting (XSS).This issue affects AT Internet Piano Analytics: from 0.0.0 before 1.0.1, from 2.0.0 before 2.3.1.
Explanation of Vulnerability in Simple Terms
The AT Internet Piano Analytics module for Drupal contains a cross-site scripting (XSS) vulnerability in versions before 1.0.1. An attacker can inject malicious scripts that execute in the browsers of site visitors or administrators. The vulnerability's exact attack vector and required privileges are not fully documented. Update to version 1.0.1 or later to resolve this issue.
What an attacker can do
Inject malicious scripts that run in visitors' browsers, potentially stealing session tokens or redirecting users.
Potential impact on your site
Visitors or admins could have their sessions hijacked or be redirected to malicious sites without their knowledge.
Conditions required to exploit
Network access to the Drupal site; specific attack vector and privilege requirements unknown.
Key dates
External resources
