Description

Cross-site scripting (XSS) vulnerability in the Form API in Drupal 6.x before 6.32 and possibly 7.x before 7.29 allows remote authenticated users with the "administer taxonomy" permission to inject arbitrary web script or HTML via an option group label.

Remediation

References

CVE-2014-5021

Related Vulnerabilities

TYPO3 Improper Authentication Vulnerability (CVE-2015-2047)

WordPress Plugin Booster for WooCommerce PHP Object Injection (3.0.1)

XWiki Improper Control of Generation of Code ('Code Injection') Vulnerability (CVE-2023-40177)

WordPress Plugin Thrive Dashboard Security Bypass (2.3.9.2)

MediaWiki Other Vulnerability (CVE-2005-0535)

Severity

Low

Classification

CVE-2014-5021 CWE-707

Tags

Missing Update Known Vulnerabilities