« Volver al listado

CVE-2012-1624

Estado: ModificadaBaja (3.5)—

Multiple cross-site scripting (XSS) vulnerabilities in the Lingotek module 6.x-1.x before 6.x-1.40 for Drupal allow remote authenticated users to inject arbitrary web script or HTML when (1) creating or (2) editing page content.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

Lingotek — Lingotek

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2012-1624",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 3.5,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:M/Au:S/C:N/I:P/A:N",
          "authentication": "SINGLE",
          "integrityImpact": "PARTIAL",
          "accessComplexity": "MEDIUM",
          "availabilityImpact": "NONE",
          "confidentialityImpact": "NONE"
        },
        "acInsufInfo": false,
        "impactScore": 2.9,
        "baseSeverity": "LOW",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 6.8,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": true
      }
    ]
  },
  "affected": [
    {
      "source": "secalert@redhat.com",
      "affectedData": [
        {
          "vendor": "n/a",
          "product": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ]
    }
  ],
  "published": "2012-10-06T21:55:04.363",
  "references": [
    {
      "url": "http://drupal.org/node/1394220",
      "source": "secalert@redhat.com"
    },
    {
      "url": "http://drupal.org/node/1394412",
      "source": "secalert@redhat.com"
    },
    {
      "url": "http://secunia.com/advisories/47453",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "secalert@redhat.com"
    },
    {
      "url": "http://www.openwall.com/lists/oss-security/2012/04/07/1",
      "source": "secalert@redhat.com"
    },
    {
      "url": "http://www.osvdb.org/78185",
      "source": "secalert@redhat.com"
    },
    {
      "url": "http://www.securityfocus.com/bid/51272",
      "source": "secalert@redhat.com"
    },
    {
      "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/72151",
      "source": "secalert@redhat.com"
    },
    {
      "url": "http://drupal.org/node/1394220",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://drupal.org/node/1394412",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://secunia.com/advisories/47453",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.openwall.com/lists/oss-security/2012/04/07/1",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.osvdb.org/78185",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.securityfocus.com/bid/51272",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/72151",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-79"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Multiple cross-site scripting (XSS) vulnerabilities in the Lingotek module 6.x-1.x before 6.x-1.40 for Drupal allow remote authenticated users to inject arbitrary web script or HTML when (1) creating or (2) editing page content."
    },
    {
      "lang": "es",
      "value": "Múltiples vulnerabilidades de ejecución de comandos en sitios cruzados (XSS) en el módulo Lingotek v6.x-1.x anteriores a v6.x-1.40 para Drupal, permite a atacantes remotos inyectar secuencias de comandos Web o HTML cuando (1) crea o (2) edita el contenido de la página."
    }
  ],
  "lastModified": "2026-06-16T23:39:54.860",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:lingotek:lingotek:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "39A90560-3577-493E-8A3C-ECF5387E2A29",
              "versionEndIncluding": "6.x-1.4"
            },
            {
              "criteria": "cpe:2.3:a:lingotek:lingotek:6.x-1.0:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "704BA43F-5C3D-4CD8-B03C-248F8EB4CFA8"
            },
            {
              "criteria": "cpe:2.3:a:lingotek:lingotek:6.x-1.1:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "AC46BD71-8277-4854-9269-D64F082AE2E8"
            },
            {
              "criteria": "cpe:2.3:a:lingotek:lingotek:6.x-1.3:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "D16A7676-20E8-4AD9-9E48-17F08044361B"
            },
            {
              "criteria": "cpe:2.3:a:lingotek:lingotek:6.x-1.31:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "2A47A501-4148-4FFA-98BD-2D59EF1987A7"
            }
          ],
          "operator": "OR"
        },
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:drupal:drupal:-:*:*:*:*:*:*:*",
              "vulnerable": false,
              "matchCriteriaId": "F8B1170D-AD33-4C7A-892D-63AC71B032CF"
            }
          ],
          "operator": "OR"
        }
      ],
      "operator": "AND"
    }
  ],
  "sourceIdentifier": "secalert@redhat.com"
}