Description

Cross-site scripting (XSS) vulnerability in the Form API in Drupal 6.x before 6.32 and possibly 7.x before 7.29 allows remote authenticated users with the "administer taxonomy" permission to inject arbitrary web script or HTML via an option group label.

Remediation

References

CVE-2014-5021

Related Vulnerabilities

ownCloud Improper Authentication Vulnerability (CVE-2016-9463)

WordPress Plugin WP Advanced Importer Cross-Site Scripting (2.1.1)

WordPress Plugin WordPress InviteBox for viral Refer-a-Friend Promotions Cross-Site Scripting (1.4.1)

Oracle Application Server CVE-2008-4014 Vulnerability (CVE-2008-4014)

IBM RTC Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Vulnerability (CVE-2018-1893)

Severity

Low

Classification

CVE-2014-5021 CWE-707

Tags

Missing Update Known Vulnerabilities