Unscored severity · published Aug 14, 2012
CVE-2012-2298
Multiple cross-site scripting (XSS) vulnerabilities in the RealName module 6.x-1.x before 6.x-1.5 for Drupal allow remote attackers to inject arbitrary web script or HTML via…
–
CVSS
2.4%
EPSS
No
On KEV
Description
Multiple cross-site scripting (XSS) vulnerabilities in the RealName module 6.x-1.x before 6.x-1.5 for Drupal allow remote attackers to inject arbitrary web script or HTML via vectors related to (1) "user names in page titles" and (2) "autocomplete callbacks."
Exploitation
Is it being used?
Exploit prediction (EPSS)2.4% · higher than 84% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
RE
Realname · Drupal
6.x-1.2 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2012-2298
CVE.org
https://www.cve.org/CVERecord?id=CVE-2012-2298
Patch
http://drupal.org/node/1547352
Patch
http://drupal.org/node/1547660
Exploit
http://drupalcode.org/project/realname.git/commitdiff/41786d0
Exploit
http://drupalcode.org/project/realname.git/commitdiff/b920794
Vendor Advisory
http://secunia.com/advisories/48936
www.openwall.com
http://www.openwall.com/lists/oss-security/2012/05/03/1