Cross-Site Scripting Flaw in Public Download Count Module for Drupal
CVE-2015-3389

Currently unrated

Key Information:

Vendor: Public Download Count Project
Status: Public Download Count
Vendor: CVE Published:; 21 April 2015

🔔 Create Public Download Count Project Vulnerability Alert

What is CVE-2015-3389?

The XSS vulnerability in the Download Count report page of the Public Download Count module for Drupal allows remote authenticated users to inject arbitrary web scripts or HTML. This can potentially lead to unauthorized actions being performed on behalf of the user, along with the exposure of sensitive information. The vulnerability affects the module in versions 7.x-1.x-dev and earlier, highlighting the importance of securing web applications against script injection attacks.

References

https://www.drupal.org/node/2420119

x_refsource_MISC

http://www.openwall.com/lists/oss-security/2015/02/05/16

mailing-listx_refsource_MLIST

http://www.securityfocus.com/bid/74271

vdb-entryx_refsource_BID

Download the Critical Vulnerability Management Cheat Sheet

Timeline

Vulnerability published
Apr 21, 2015
Vulnerability Reserved
Apr 21, 2015

CVE-2015-3389 Data

JSON