CVE-2012-2298

MEDIUM 4.3CVE-2012-2298 · Published 14/08/2012 · updated 16/06/2026

In short

CVE-2012-2298 is a MEDIUM (CVSS 4.3) vulnerability affecting realname (drupal), realname (nancy wichmann).
Chance of exploitation in the next 30 days (EPSS): 2.4%, higher than 84.3% of all vulnerabilities.
No patched version is listed yet: follow the vendor's advisory in References.

Package	Affected versions	Patched versions
realname drupal	`= 6.x-1.2`	No fix yet
realname nancy_wichmann	`= 6.x-1.0= 6.x-1.1= 6.x-1.2= 6.x-1.3= 6.x-1.4= 6.x-1.x`	No fix yet

Description

Multiple cross-site scripting (XSS) vulnerabilities in the RealName module 6.x-1.x before 6.x-1.5 for Drupal allow remote attackers to inject arbitrary web script or HTML via vectors related to (1) "user names in page titles" and (2) "autocomplete callbacks."

References

drupal.org/node/1547352 · Patch
drupal.org/node/1547660 · Patch
drupalcode.org/project/realname.git/commitdiff/41786d0 · Exploit
drupalcode.org/project/realname.git/commitdiff/b920794 · Exploit
secunia.com/advisories/48936 · Vendor Advisory
openwall.com/lists/oss-security/2012/05/03/1
openwall.com/lists/oss-security/2012/05/03/2
securityfocus.com/bid/53250
exchange.xforce.ibmcloud.com/vulnerabilities/75181

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free