CVE-2012-2070

NIEDRIG 2.1CVE-2012-2070 · Published 14/08/2012 · updated 16/06/2026

Kurz gesagt

CVE-2012-2070 ist eine Schwachstelle (NIEDRIG (CVSS 2.1)) in multiblock (andrew levine).
Wahrscheinlichkeit einer Ausnutzung in den nächsten 30 Tagen (EPSS): 1.3%, höher als bei 71.0% aller Schwachstellen.
Noch keine gepatchte Version bekannt: Herstellerhinweise unter Referenzen verfolgen.

Package	Affected versions	Patched versions
multiblock andrew_levine	`= 6.x-1.1= 6.x-1.2= 6.x-1.3= 6.x-1.x= 7.x-1.0= 7.x-1.x`	No fix yet

Description

Cross-site scripting (XSS) vulnerability in the MultiBlock module 6.x-1.x before 6.x-1.4 and 7.x-1.x before 7.x-1.1 for Drupal allows remote authenticated users with the administer blocks permission to inject arbitrary web script or HTML via the block title.

References

drupal.org/node/1505410 · Patch
drupal.org/node/1505414 · Patch
drupal.org/node/1506390 · Patch
drupalcode.org/project/multiblock.git/commit/2c5177b
drupalcode.org/project/multiblock.git/commit/aee07d3
osvdb.org/80673
secunia.com/advisories/48588 · Vendor Advisory
madirish.net/content/drupal-multiblock-6x-13-xss-vulnerability · Exploit
openwall.com/lists/oss-security/2012/04/07/1
securityfocus.com/bid/52800
exchange.xforce.ibmcloud.com/vulnerabilities/74466

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free