Unscored severity · published Jun 15, 2015
CVE-2015-4381
Cross-site scripting (XSS) vulnerability in the Invoice module 6.x-1.x before 6.x-1.2 and 7.x-1.x before 7.x-1.3 for Drupal allows remote authenticated users with the "Administer…
–
CVSS
0.9%
EPSS
No
On KEV
Description
Cross-site scripting (XSS) vulnerability in the Invoice module 6.x-1.x before 6.x-1.2 and 7.x-1.x before 7.x-1.3 for Drupal allows remote authenticated users with the "Administer own invoices" permission to inject arbitrary web script or HTML via unspecified vectors involving nodes of the "Invoice" content type.
Exploitation
Is it being used?
Exploit prediction (EPSS)0.9% · higher than 61% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
IN
Invoice · Invoice Project
6.x-1.1; 7.x-1.x-dev · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2015-4381
CVE.org
https://www.cve.org/CVERecord?id=CVE-2015-4381
www.openwall.com
http://www.openwall.com/lists/oss-security/2015/04/25/6
www.securityfocus.com
http://www.securityfocus.com/bid/74345
Patch
https://www.drupal.org/node/2459337
Patch
https://www.drupal.org/node/2474135
Patch
https://www.drupal.org/node/2474139
More from Invoice
–
CVE-2015-4382
Multiple cross-site request forgery (CSRF) vulnerabilities in the Invoice module 6.x-1.x before 6.x-1.2 and 7.x-1.x before 7.x-1.3 for Drupal allow remote attackers to hijack the…