Unscored severity · published Jun 27, 2012
CVE-2012-2711
Multiple cross-site scripting (XSS) vulnerabilities in the Taxonomy List module 6.x-1.x before 6.x-1.4 for Drupal allow remote authenticated users with create or edit taxonomy…
–
CVSS
1.7%
EPSS
No
On KEV
Description
Multiple cross-site scripting (XSS) vulnerabilities in the Taxonomy List module 6.x-1.x before 6.x-1.4 for Drupal allow remote authenticated users with create or edit taxonomy terms permissions to inject arbitrary web script or HTML via vectors related to taxonomy information.
Exploitation
Is it being used?
Exploit prediction (EPSS)1.7% · higher than 77% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
TL
Taxonomy List · Nancy Wichmann
6.x-1.0; 6.x-1.0-beta1; 6.x-1.1; 6.x-1.2; 6.x-1.2; 6.x-1.3; +1 more · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2012-2711
CVE.org
https://www.cve.org/CVERecord?id=CVE-2012-2711
Patch
http://drupal.org/node/1595396
Patch
http://drupal.org/node/1597262
Exploit
http://drupalcode.org/project/taxonomy_list.git/commitdiff/7dd21a0
Vendor Advisory
http://secunia.com/advisories/49238
www.openwall.com
http://www.openwall.com/lists/oss-security/2012/06/14/3
www.osvdb.org
http://www.osvdb.org/82164