Unscored severity · published Aug 14, 2012
CVE-2012-2082
Cross-site scripting (XSS) vulnerability in the Chaos tool suite (aka CTools) module 7.x-1.x before 7.x-1.0 for Drupal allows remote authenticated users with the post comments…
–
CVSS
1.6%
EPSS
No
On KEV
Description
Cross-site scripting (XSS) vulnerability in the Chaos tool suite (aka CTools) module 7.x-1.x before 7.x-1.0 for Drupal allows remote authenticated users with the post comments permission to inject arbitrary web script or HTML via a user signature.
Exploitation
Is it being used?
Exploit prediction (EPSS)1.6% · higher than 76% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
CT
Ctools · Chaos Tool Suite Project
7.x-1.0; 7.x-1.0; 7.x-1.0; 7.x-1.0; 7.x-1.0; 7.x-1.0; +2 more · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2012-2082
CVE.org
https://www.cve.org/CVERecord?id=CVE-2012-2082
Patch
http://drupal.org/node/1507412
Patch
http://drupal.org/node/1507466
Patch
http://drupalcode.org/project/ctools.git/commit/755b3c4
osvdb.org
http://osvdb.org/80679
Vendor Advisory
http://secunia.com/advisories/48616
www.openwall.com
http://www.openwall.com/lists/oss-security/2012/04/07/1
More from Ctools
7.5
CVE-2015-7875
ctools 6.x-1.x before 6.x-1.14 and 7.x-1.x before 7.x-1.8 in Drupal does not verify the "edit" permission for the "content type" plugins that are used on Panels and similar…
–
CVE-2015-6665
Cross-site scripting (XSS) vulnerability in the Ajax handler in Drupal 7.x before 7.39 and the Ctools module 6.x-1.x before 6.x-1.14 for Drupal allows remote attackers to inject…
–
CVE-2015-4398
Open redirect vulnerability in the Chaos tool suite (ctools) module before 6.x-1.12 and 7.x-1.x before 7.x-1.7 for Drupal allows remote attackers to redirect users to arbitrary…
–
CVE-2015-4375
The Chaos tool suite (ctools) module 7.x-1.x before 7.x-1.7 for Drupal allows remote attackers to obtain sensitive node titles via (1) an autocomplete search on custom entities…
–
CVE-2013-1925
The Chaos Tool Suite (ctools) module 7.x-1.x before 7.x-1.3 for Drupal does not properly restrict node access, which allows remote authenticated users with the "access content"…