CVE-2013-0319

Cross-site scripting (XSS) vulnerability in the Yandex.Metrics module 6.x-1.x before 6.x-1.6 and 7.x-1.x before 7.x-1.5 for Drupal allows remote attackers to inject arbitrary web script or HTML via vectors related to the Yandex.Metrica service data.

Score

CVSS 2.0 4.3 Medium

Status

Modified - secalert@redhat.com

Published

2013-03-27

Last modified

2024-09-17

Weaknesses

CWE-79

Affected products

• Yandex Metrics (Yandex.metrics Project)

References

• http://drupal.org/node/1921340
• http://drupal.org/node/1921342
• http://drupal.org/node/1922400
• http://drupalcode.org/project/yandex_metrics.git/commitdiff/290b718
• http://drupalcode.org/project/yandex_metrics.git/commitdiff/80bb901
• http://www.openwall.com/lists/oss-security/2013/02/21/5