Unscored severity · published Jan 19, 2014
CVE-2013-0244
Cross-site scripting (XSS) vulnerability in Drupal 6.x before 6.28 and 7.x before 7.19, when running with older versions of jQuery that are vulnerable to CVE-2011-4969, allows…
–
CVSS
2.1%
EPSS
No
On KEV
Description
Cross-site scripting (XSS) vulnerability in Drupal 6.x before 6.28 and 7.x before 7.19, when running with older versions of jQuery that are vulnerable to CVE-2011-4969, allows remote attackers to inject arbitrary web script or HTML via vectors involving unspecified Javascript functions that are used to select DOM elements.
Exploitation
Is it being used?
Exploit prediction (EPSS)2.1% · higher than 82% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
DR
Drupal · Drupal
7.0; 7.0; 7.0; 7.0; 7.0; 7.0; +34 more · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2013-0244
CVE.org
https://www.cve.org/CVERecord?id=CVE-2013-0244
osvdb.org
http://osvdb.org/89306
packetstormsecurity.com
http://packetstormsecurity.com/files/119598/Drupal-Core-6.x-7.x-Cross-Site-Scripting-Access-Bypass.html
seclists.org
http://seclists.org/fulldisclosure/2013/Jan/120
seclists.org
http://seclists.org/oss-sec/2013/q1/211
www.debian.org
http://www.debian.org/security/2013/dsa-2776
Patch
https://drupal.org/SA-CORE-2013-001
More from Drupal
9.8
CVE-2026-9082
Drupal core - Highly critical - SQL injection - SA-CORE-2026-004
9.8
CVE-2018-7602
Drupal core - Highly critical - Remote Code Execution - SA-CORE-2018-004
9.8
CVE-2018-7600
Drupal Core Remote Code Execution Vulnerability
8.8
CVE-2020-13671
Drupal core Un-restricted Upload of File
8.1
CVE-2019-6340
Drupal core - Highly critical - Remote Code Execution