« Volver al listado

CVE-2012-1639

Estado: ModificadaBaja (3.5)—

Multiple cross-site scripting (XSS) vulnerabilities in product/commerce_product.module in the Drupal Commerce module for Drupal before 7.x-1.2 allow remote authenticated users to inject arbitrary web script or HTML via the (1) sku or (2) title parameters.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

Commerceguys — Commerce

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2012-1639",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 3.5,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:M/Au:S/C:N/I:P/A:N",
          "authentication": "SINGLE",
          "integrityImpact": "PARTIAL",
          "accessComplexity": "MEDIUM",
          "availabilityImpact": "NONE",
          "confidentialityImpact": "NONE"
        },
        "acInsufInfo": false,
        "impactScore": 2.9,
        "baseSeverity": "LOW",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 6.8,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": true
      }
    ]
  },
  "affected": [
    {
      "source": "secalert@redhat.com",
      "affectedData": [
        {
          "vendor": "n/a",
          "product": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ]
    }
  ],
  "published": "2012-10-01T20:55:03.783",
  "references": [
    {
      "url": "http://drupal.org/node/1416824",
      "tags": [
        "Patch",
        "Vendor Advisory"
      ],
      "source": "secalert@redhat.com"
    },
    {
      "url": "http://drupalcode.org/project/commerce.git/blobdiff/45bc53875f1675750afe60e709a34c95e3008366..b74cdcd:/modules/product/commerce_product.module",
      "source": "secalert@redhat.com"
    },
    {
      "url": "http://osvdb.org/78528",
      "source": "secalert@redhat.com"
    },
    {
      "url": "http://secunia.com/advisories/47730",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "secalert@redhat.com"
    },
    {
      "url": "http://www.openwall.com/lists/oss-security/2012/04/07/1",
      "source": "secalert@redhat.com"
    },
    {
      "url": "http://www.securityfocus.com/bid/51668",
      "source": "secalert@redhat.com"
    },
    {
      "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/72743",
      "source": "secalert@redhat.com"
    },
    {
      "url": "http://drupal.org/node/1416824",
      "tags": [
        "Patch",
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://drupalcode.org/project/commerce.git/blobdiff/45bc53875f1675750afe60e709a34c95e3008366..b74cdcd:/modules/product/commerce_product.module",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://osvdb.org/78528",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://secunia.com/advisories/47730",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.openwall.com/lists/oss-security/2012/04/07/1",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.securityfocus.com/bid/51668",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/72743",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-79"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Multiple cross-site scripting (XSS) vulnerabilities in product/commerce_product.module in the Drupal Commerce module for Drupal before 7.x-1.2 allow remote authenticated users to inject arbitrary web script or HTML via the (1) sku or (2) title parameters."
    },
    {
      "lang": "es",
      "value": "Múltiples vulnerabilidades de falsificación de petición en sitios cruzados (CSRF) en el módulo enproduct/commerce_product.module en el módulo Drupal Commerce para Drupal anteriores a v7.x-1.2, permite a atacantes remotos secuestrar la autenticación de los usuarios para inyectar comandos web o html a través de los parámetros (1) sku o (2) title."
    }
  ],
  "lastModified": "2026-06-16T23:39:56.493",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:drupal:drupal:-:*:*:*:*:*:*:*",
              "vulnerable": false,
              "matchCriteriaId": "F8B1170D-AD33-4C7A-892D-63AC71B032CF"
            }
          ],
          "operator": "OR"
        },
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:commerceguys:commerce:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "04D29FF2-2D39-4DE7-8965-9DD40B8E27DC",
              "versionEndIncluding": "7.x-1.1"
            },
            {
              "criteria": "cpe:2.3:a:commerceguys:commerce:7.x-1.0:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "36BE5A7F-A97B-41A2-ADE6-F4D64CE7C046"
            },
            {
              "criteria": "cpe:2.3:a:commerceguys:commerce:7.x-1.0:alpha1:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "D64B0AFA-E9EE-41F9-81C3-6A6BD039021A"
            },
            {
              "criteria": "cpe:2.3:a:commerceguys:commerce:7.x-1.0:alpha2:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "4261C160-8926-4DAC-B2BC-A63D67305144"
            },
            {
              "criteria": "cpe:2.3:a:commerceguys:commerce:7.x-1.0:alpha3:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "AB5E1423-1492-45CC-83FC-9D4A5A0F98EE"
            },
            {
              "criteria": "cpe:2.3:a:commerceguys:commerce:7.x-1.0:alpha4:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "AD023352-F7CE-4D2C-A21B-8CF34F1450BB"
            },
            {
              "criteria": "cpe:2.3:a:commerceguys:commerce:7.x-1.0:alpha5:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "CDA3BB6E-7F11-49EE-B028-989230DBACDD"
            },
            {
              "criteria": "cpe:2.3:a:commerceguys:commerce:7.x-1.0:beta1:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "0252DCA1-8E3A-4E0A-923C-BC03D32D7C05"
            },
            {
              "criteria": "cpe:2.3:a:commerceguys:commerce:7.x-1.0:beta2:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "2ABE5EA8-E848-48BA-A4D3-235DF0B47923"
            },
            {
              "criteria": "cpe:2.3:a:commerceguys:commerce:7.x-1.0:beta3:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "A93AF10B-0D25-4749-8FE3-91F02F9B7F5A"
            },
            {
              "criteria": "cpe:2.3:a:commerceguys:commerce:7.x-1.0:beta4:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "5BF49E58-1B39-4547-9A7A-F87D45DD05B7"
            },
            {
              "criteria": "cpe:2.3:a:commerceguys:commerce:7.x-1.0:rc1:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "872145E2-7B5D-4147-9A1A-B8F3DE95DADC"
            },
            {
              "criteria": "cpe:2.3:a:commerceguys:commerce:7.x-1.0:rc2:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "8B651A2F-2097-4375-B251-AE354B95D06C"
            },
            {
              "criteria": "cpe:2.3:a:commerceguys:commerce:7.x-1.x:dev:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "31E1F368-B3AD-421E-894D-DFB45B812A4C"
            }
          ],
          "operator": "OR"
        }
      ],
      "operator": "AND"
    }
  ],
  "sourceIdentifier": "secalert@redhat.com"
}