Unscored severity · published Feb 9, 2015
CVE-2015-1567
Cross-site scripting (XSS) vulnerability in the admin page in the GD Infinite Scroll module before 7.x-1.4 for Drupal allows remote authenticated users with the "edit gd infinite…
–
CVSS
1.1%
EPSS
No
On KEV
Description
Cross-site scripting (XSS) vulnerability in the admin page in the GD Infinite Scroll module before 7.x-1.4 for Drupal allows remote authenticated users with the "edit gd infinite scroll settings" permission to inject arbitrary web script or HTML via unspecified vectors.
Exploitation
Is it being used?
Exploit prediction (EPSS)1.1% · higher than 67% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
GI
GD Infinite Scroll · Studio.gd
through 7.x-1.3 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2015-1567
CVE.org
https://www.cve.org/CVERecord?id=CVE-2015-1567
exchange.xforce.ibmcloud.com
https://exchange.xforce.ibmcloud.com/vulnerabilities/100629
Patch
https://www.drupal.org/node/2415219
Vendor Advisory
https://www.drupal.org/node/2415885
More from GD Infinite Scroll
–
CVE-2015-1568
Cross-site request forgery (CSRF) vulnerability in the GD Infinite Scroll module before 7.x-1.4 for Drupal allows remote attackers to hijack the authentication of users with the…