« Volver al listado

CVE-2026-2348

Estado: AnalizadaMedia (5.4)—

Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Quick Edit allows Cross-Site Scripting (XSS).This issue affects Quick Edit: from 0.0.0 before 1.0.5, from 2.0.0 before 2.0.1.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

Wim-leers — Quick Edit

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2026-2348",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2026-2348",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2026-03-25T20:03:51.458683Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "cvssData": {
          "scope": "CHANGED",
          "version": "3.1",
          "baseScore": 5.4,
          "attackVector": "NETWORK",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N",
          "integrityImpact": "LOW",
          "userInteraction": "REQUIRED",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "LOW",
          "confidentialityImpact": "LOW"
        },
        "impactScore": 2.7,
        "exploitabilityScore": 2.3
      }
    ]
  },
  "affected": [
    {
      "source": "mlhess@drupal.org",
      "affectedData": [
        {
          "repo": "https://git.drupalcode.org/project/quickedit",
          "vendor": "Drupal",
          "product": "Quick Edit",
          "versions": [
            {
              "status": "affected",
              "version": "0.0.0",
              "lessThan": "1.0.5",
              "versionType": "semver"
            },
            {
              "status": "affected",
              "version": "2.0.0",
              "lessThan": "2.0.1",
              "versionType": "semver"
            }
          ],
          "collectionURL": "https://www.drupal.org/project/quickedit",
          "defaultStatus": "unaffected"
        }
      ]
    }
  ],
  "published": "2026-03-25T16:16:21.517",
  "references": [
    {
      "url": "https://www.drupal.org/sa-contrib-2026-009",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "mlhess@drupal.org"
    }
  ],
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "mlhess@drupal.org",
      "description": [
        {
          "lang": "en",
          "value": "CWE-79"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Improper Neutralization of Input During Web Page Generation (\"Cross-site Scripting\") vulnerability in Drupal Quick Edit allows Cross-Site Scripting (XSS).This issue affects Quick Edit: from 0.0.0 before 1.0.5, from 2.0.0 before 2.0.1."
    },
    {
      "lang": "es",
      "value": "Neutralización Incorrecta de la Entrada Durante la Generación de Páginas Web (cross-site scripting) vulnerabilidad en Drupal Quick Edit permite cross-site scripting (XSS). Este problema afecta a Quick Edit: desde 0.0.0 antes de 1.0.5, desde 2.0.0 antes de 2.0.1."
    }
  ],
  "lastModified": "2026-06-17T10:30:49.287",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:wim-leers:quick_edit:*:*:*:*:*:drupal:*:*",
              "vulnerable": true,
              "matchCriteriaId": "0112205D-A715-4F4F-A0A9-8B5D56E38132",
              "versionEndExcluding": "1.0.5"
            },
            {
              "criteria": "cpe:2.3:a:wim-leers:quick_edit:2.0.0:*:*:*:*:drupal:*:*",
              "vulnerable": true,
              "matchCriteriaId": "D0966B64-537B-40DA-9CAE-411915832BD4"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "mlhess@drupal.org"
}