CVSS base score
What the vulnerability does
Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Colorbox Inline allows Cross-Site Scripting (XSS). This issue affects Colorbox Inline: from 0.0.0 before 2.1.1.
Explanation of Vulnerability in Simple Terms
The Colorbox Inline module for Drupal contains a cross-site scripting (XSS) vulnerability in versions before 2.1.1. An attacker can inject malicious scripts that execute in the browsers of site visitors. The vulnerability exists in how the module processes user-supplied input without proper sanitization. Site administrators should update to version 2.1.1 or later immediately.
What an attacker can do
Inject malicious JavaScript that runs in visitors' browsers and steals session cookies or credentials.
Potential impact on your site
Visitors' accounts and data are at risk if they click attacker-controlled links or visit compromised pages.
Conditions required to exploit
No authentication required; typically requires the attacker to craft a malicious link or page that a site visitor clicks.
Key dates
External resources
