vulnwire
6.1med

CVE-2016-7571

Drupal Cross-site scripting (XSS) vulnerability

Also known as GHSA-vhg8-x858-7wq6

Published 10 y ago · modified 4 mo ago · JSON

CVSS
6.1
v3.0 · NVD
CISA KEV
No
not known exploited
EPSS
1.5%
percentile 74%
Public exploits
0
none known

Cross-site scripting (XSS) vulnerability in Drupal 8.x before 8.1.10 allows remote attackers to inject arbitrary web script or HTML via vectors involving an HTTP exception.

Exploit prediction (EPSS)

1.49% probability of exploitation in the next 30 days, higher than 74% of all scored CVEs.

CVSS scores

Assigned byVersionScoreVector
NVD3.06.1CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
NVD2.04.3AV:N/AC:M/Au:N/C:N/I:P/A:N
GitHub3.06.1CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Affected packages

EcosystemPackageAffectedFixed in
packagistdrupal/core
>=8.0, <8.1.10
8.1.10
packagistdrupal/drupal
>=8.0, <8.1.10
8.1.10

Classification

Weakness
  • CWE-79 Improper Neutralization of Input During Web Page Generation

References

  • drupal.org /SA-CORE-2016-004 · x_refsource_CONFIRM, x_transferred
  • securityfocus.com /bid/93101 · vdb-entry, x_refsource_BID, x_transferred
  • securitytracker.com /id/1036886 · vdb-entry, x_refsource_SECTRACK, x_transferred
  • nvd.nist.gov /vuln/detail/CVE-2016-7571 · advisory
  • github.com /FriendsOfPHP/security-advisories/blob/master/drupal/core/CVE-2016-7571.yaml · web
  • github.com /FriendsOfPHP/security-advisories/blob/master/drupal/drupal/CVE-2016-7571.yaml · web
  • github.com /drupal/core · package

Sources

vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.