CVE-2012-2717

MEDIUM 4.3CVE-2012-2717 · Published 27/06/2012 · updated 16/06/2026

In short

CVE-2012-2717 is a MEDIUM (CVSS 4.3) vulnerability affecting mobile tools (mathew winstone).
Chance of exploitation in the next 30 days (EPSS): 2.4%, higher than 84.4% of all vulnerabilities.
No patched version is listed yet: follow the vendor's advisory in References.

Package	Affected versions	Patched versions
mobile tools mathew_winstone	`= 6.x-2.0= 6.x-2.1= 6.x-2.2= 6.x-2.x`	No fix yet

Description

Multiple cross-site scripting (XSS) vulnerabilities in the Mobile Tools module 6.x-2.x before 6.x-2.3 for Drupal allow remote attackers to inject arbitrary web script or HTML via the (1) Mobile URL field or (2) Desktop URL field to the General configuration page, or the (3) message to the Mobile Tools block message options.

References

drupal.org/node/1169008 · Patch
drupal.org/node/1608828 · Patch
drupalcode.org/project/mobile_tools.git/commitdiff/614b0fc · Exploit
osvdb.org/82410
secunia.com/advisories/49318 · Vendor Advisory
madirish.net/content/drupal-mobile-tools-6x-23-xss
openwall.com/lists/oss-security/2012/06/14/3
securityfocus.com/bid/53734 · Patch
exchange.xforce.ibmcloud.com/vulnerabilities/76002

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free