« Volver al listado

CVE-2014-8743

Estado: ModificadaBaja (3.5)—

Multiple cross-site scripting (XSS) vulnerabilities in the Maestro module 7.x-1.x before 7.x-1.4 for Drupal allow remote authenticated users with certain permissions to inject arbitrary web script or HTML via a (1) Role or (2) Organic Group name.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

Drupal — Maestro

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2014-8743",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 3.5,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:M/Au:S/C:N/I:P/A:N",
          "authentication": "SINGLE",
          "integrityImpact": "PARTIAL",
          "accessComplexity": "MEDIUM",
          "availabilityImpact": "NONE",
          "confidentialityImpact": "NONE"
        },
        "acInsufInfo": false,
        "impactScore": 2.9,
        "baseSeverity": "LOW",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 6.8,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": true
      }
    ]
  },
  "affected": [
    {
      "source": "cve@mitre.org",
      "affectedData": [
        {
          "vendor": "n/a",
          "product": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ]
    }
  ],
  "published": "2014-10-13T18:55:02.743",
  "references": [
    {
      "url": "http://secunia.com/advisories/56790",
      "source": "cve@mitre.org"
    },
    {
      "url": "http://www.securityfocus.com/bid/65677",
      "source": "cve@mitre.org"
    },
    {
      "url": "https://drupal.org/node/2200453",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "cve@mitre.org"
    },
    {
      "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/91274",
      "source": "cve@mitre.org"
    },
    {
      "url": "https://www.drupal.org/node/2013653",
      "tags": [
        "Patch"
      ],
      "source": "cve@mitre.org"
    },
    {
      "url": "http://secunia.com/advisories/56790",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.securityfocus.com/bid/65677",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://drupal.org/node/2200453",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/91274",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://www.drupal.org/node/2013653",
      "tags": [
        "Patch"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-79"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Multiple cross-site scripting (XSS) vulnerabilities in the Maestro module 7.x-1.x before 7.x-1.4 for Drupal allow remote authenticated users with certain permissions to inject arbitrary web script or HTML via a (1) Role or (2) Organic Group name."
    },
    {
      "lang": "es",
      "value": "Múltiples vulnerabilidades de XSS en el módulo Maestro 7.x-1.x anterior a 7.x-1.4 para Drupal permiten a usuarios remotos autenticados con ciertos permisos inyectar secuencias de comandos web o HTML arbitrarios a través de un nombre de (1) rol o (2) grupo orgánico."
    }
  ],
  "lastModified": "2026-06-17T00:17:15.567",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:drupal:maestro:7.x-1.0:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "27F5604C-5C95-47CE-A186-B5F7553B26AC"
            },
            {
              "criteria": "cpe:2.3:a:drupal:maestro:7.x-1.0:alpha1:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "FC851373-F0D6-41F4-B1C3-995AA8561667"
            },
            {
              "criteria": "cpe:2.3:a:drupal:maestro:7.x-1.0:alpha2:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "059B0DEE-F4FB-435A-8288-B420DAB84699"
            },
            {
              "criteria": "cpe:2.3:a:drupal:maestro:7.x-1.0:alpha3:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "0ABC7DF8-9BDB-4265-B3D4-0CA80EBD26C5"
            },
            {
              "criteria": "cpe:2.3:a:drupal:maestro:7.x-1.0:rc1:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "EF988F65-3525-4D66-8714-D2854C686D32"
            },
            {
              "criteria": "cpe:2.3:a:drupal:maestro:7.x-1.1:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "8C3D1ED3-3657-4B08-8DCD-6F387942BA9D"
            },
            {
              "criteria": "cpe:2.3:a:drupal:maestro:7.x-1.2:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "08D4F917-57B1-4DCA-83E4-FA389B79264E"
            },
            {
              "criteria": "cpe:2.3:a:drupal:maestro:7.x-1.3:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "5C6888A9-5E21-4E41-942A-692FB4FF7965"
            },
            {
              "criteria": "cpe:2.3:a:drupal:maestro:7.x-1.x-dev:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "DE206D9A-E6CD-41C5-AA8F-5F6AE57B19F8"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "cve@mitre.org"
}