CVSS base score
CVSS vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N
What the vulnerability does
Simple Hierarchical Select (SHS) for Drupal 7 contains cross-site scripting risk due to improper output escaping of term-derived text. Confirmed affected paths include field formatter output (shs_field_formatter_view) and term-tree child-term data generation (shs_term_get_children). Malicious taxonomy term names can be rendered unsafely depending on output context. This affects versions from 7.x-1.0 through (and including) 7.x-1.10.
Explanation of Vulnerability in Simple Terms
A vulnerability in the Drupal Simple Hierarchical Select module allows authenticated users to perform unintended actions through user interaction. The module fails to properly validate certain operations, enabling a logged-in user to trigger unwanted behavior by visiting a crafted page or link. This affects versions 7.x-1.0 through 7.x-1.10.
What an attacker can do
A logged-in user can trigger unintended module behavior by visiting a crafted link or page.
Potential impact on your site
Authenticated users could perform actions the module did not intend to allow, potentially affecting site data or functionality.
Conditions required to exploit
Attacker must have a valid Drupal user account and the victim must click a malicious link.
Key dates
External resources
