CVE-2012-2708

LOW 2.1CVE-2012-2708 · Published 27/06/2012 · updated 16/06/2026

In short

CVE-2012-2708 is a LOW (CVSS 2.1) vulnerability affecting hostmaster (antoine beaupre).
Chance of exploitation in the next 30 days (EPSS): 1.6%, higher than 75.9% of all vulnerabilities.
No patched version is listed yet: follow the vendor's advisory in References.

Package	Affected versions	Patched versions
hostmaster antoine_beaupre	`= 6.x-1.2= 6.x-1.3= 6.x-1.4= 6.x-1.5= 6.x-1.6= 6.x-1.7= 6.x-1.8= 6.x-1.x`	No fix yet

Description

Cross-site scripting (XSS) vulnerability in the _hosting_task_log_table function in modules/hosting/task/hosting_task.module in the Hostmaster (Aegir) module 6.x-1.x before 6.x-1.9 for Drupal allows remote authenticated users with certain permissions to inject arbitrary web script or HTML via a Drush log message in a provision task log.

References

community.aegirproject.org/1.9
drupal.org/node/1585658 · Patch
drupal.org/node/1585678 · Vendor Advisory
drupalcode.org/project/hostmaster.git/commitdiff/9476561 · Exploit
openwall.com/lists/oss-security/2012/06/14/3
securityfocus.com/bid/53588
exchange.xforce.ibmcloud.com/vulnerabilities/75714

More vulnerabilities in hostmaster

See all →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free