Vulnerability Details CVE-2015-3353
Cross-site scripting (XSS) vulnerability in the Field Display Label module before 7.x-1.3 for Drupal allows remote authenticated users to inject arbitrary web script or HTML via the alternate field label in content types settings.
Exploit prediction scoring system (EPSS) score
EPSS Score 0.002
EPSS Ranking 42.5%
CVSS Severity
CVSS v2 Score 3.5
References
- http://www.openwall.com/lists/oss-security/2015/01/29/6
- http://www.securityfocus.com/bid/71962
- https://www.drupal.org/node/2403057
- https://www.drupal.org/node/2403489
- http://www.openwall.com/lists/oss-security/2015/01/29/6
- http://www.securityfocus.com/bid/71962
- https://www.drupal.org/node/2403057
- https://www.drupal.org/node/2403489
Products affected by CVE-2015-3353
-
cpe:2.3:a:field_display_label_project:field_display_label:7.x-1.2