CVSS base score
What the vulnerability does
Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Quick Edit allows Cross-Site Scripting (XSS).This issue affects Quick Edit: from 0.0.0 before 1.0.5, from 2.0.0 before 2.0.1.
Explanation of Vulnerability in Simple Terms
The Quick Edit module for Drupal contains a cross-site scripting (XSS) vulnerability in versions before 1.0.5. An attacker can inject malicious scripts that execute in the browsers of site administrators or editors using the quick edit feature. The vulnerability arises from insufficient input sanitization when processing user-supplied data in the quick edit interface.
What an attacker can do
Inject malicious scripts that run in the browser of site editors or admins using quick edit.
Potential impact on your site
Site editors and admins could have their sessions hijacked, credentials stolen, or site content modified without their knowledge.
Conditions required to exploit
Attacker needs network access to the site; user interaction required (victim must use quick edit feature).
Key dates
External resources
Related vulnerabilities
