CVE-2012-4469

LOW 2.6CVE-2012-4469 · Published 30/11/2012 · updated 16/06/2026

In short

CVE-2012-4469 is a LOW (CVSS 2.6) vulnerability affecting hashcash (simon rycroft).
Chance of exploitation in the next 30 days (EPSS): 1.2%, higher than 67.2% of all vulnerabilities.
No patched version is listed yet: follow the vendor's advisory in References.

Package	Affected versions	Patched versions
hashcash simon_rycroft	`= 6.x-2.0= 6.x-2.1= 6.x-2.2= 6.x-2.3= 6.x-2.4= 6.x-2.5= 7.x-2.0= 7.x-2.1`	No fix yet

Description

Cross-site scripting (XSS) vulnerability in the Hashcash module 6.x-2.x before 6.x-2.6 and 7.x-2.x before 7.x-2.2 for Drupal, when "Log failed hashcash" is enabled, allows remote attackers to inject arbitrary web script or HTML via an invalid token, which is not properly handled when administrators use the Database logging module.

References

drupal.org/node/1650784 · Patch
drupal.org/node/1650790 · Patch
drupal.org/node/1663306 · Patch
openwall.com/lists/oss-security/2012/10/04/3

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free