« Volver al listado

CVE-2025-7715

Estado: AnalizadaMedia (6.1)—

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal Block Attributes allows Cross-Site Scripting (XSS).This issue affects Block Attributes: from 0.0.0 before 1.1.0, from 2.0.0 before 2.0.1.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

Block Attributes Project — Block Attributes

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2025-7715",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2025-7715",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2025-07-22T14:02:14.380991Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "cvssData": {
          "scope": "CHANGED",
          "version": "3.1",
          "baseScore": 6.1,
          "attackVector": "NETWORK",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
          "integrityImpact": "LOW",
          "userInteraction": "REQUIRED",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "LOW"
        },
        "impactScore": 2.7,
        "exploitabilityScore": 2.8
      }
    ]
  },
  "affected": [
    {
      "source": "mlhess@drupal.org",
      "affectedData": [
        {
          "repo": "https://git.drupalcode.org/project/block_attributes",
          "vendor": "Drupal",
          "product": "Block Attributes",
          "versions": [
            {
              "status": "affected",
              "version": "0.0.0",
              "lessThan": "1.1.0",
              "versionType": "semver"
            },
            {
              "status": "affected",
              "version": "2.0.0",
              "lessThan": "2.0.1",
              "versionType": "semver"
            }
          ],
          "collectionURL": "https://www.drupal.org/project/block_attributes",
          "defaultStatus": "unaffected"
        }
      ]
    }
  ],
  "published": "2025-07-21T17:15:37.963",
  "references": [
    {
      "url": "https://www.drupal.org/sa-contrib-2025-090",
      "tags": [
        "Third Party Advisory"
      ],
      "source": "mlhess@drupal.org"
    }
  ],
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "mlhess@drupal.org",
      "description": [
        {
          "lang": "en",
          "value": "CWE-79"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal Block Attributes allows Cross-Site Scripting (XSS).This issue affects Block Attributes: from 0.0.0 before 1.1.0, from 2.0.0 before 2.0.1."
    },
    {
      "lang": "es",
      "value": "La vulnerabilidad de neutralización incorrecta de la entrada durante la generación de páginas web ('Cross-site Scripting') en Drupal Block Attributes permite la ejecución de cross-site scripting (XSS). Este problema afecta a los atributos de bloque: desde la versión 0.0.0 hasta la 1.1.0 y desde la versión 2.0.0 hasta la 2.0.1."
    }
  ],
  "lastModified": "2026-06-17T10:05:31.060",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:block_attributes_project:block_attributes:*:*:*:*:*:drupal:*:*",
              "vulnerable": true,
              "matchCriteriaId": "C560FDFF-4D04-41FB-8151-865427CB74E6",
              "versionEndExcluding": "8.x-1.1",
              "versionStartIncluding": "7.x-1.x-dev"
            },
            {
              "criteria": "cpe:2.3:a:block_attributes_project:block_attributes:2.0.0:*:*:*:*:drupal:*:*",
              "vulnerable": true,
              "matchCriteriaId": "999C5A80-AF03-40F7-9F39-D33980D335EE"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "mlhess@drupal.org"
}