Description

Cross-site scripting (XSS) vulnerability in the Ajax system in Drupal 7.x before 7.29 allows remote attackers to inject arbitrary web script or HTML via vectors involving forms with an Ajax-enabled textfield and a file field.

Remediation

References

CVE-2014-5022

Related Vulnerabilities

ownCloud Exposure of Sensitive Information to an Unauthorized Actor Vulnerability (CVE-2012-4390)

MediaWiki Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Vulnerability (CVE-2024-40599)

WordPress Plugin WooCommerce Save For Later Cart Enhancement PHP Object Injection (1.0.6)

Jetty Uncontrolled Resource Consumption Vulnerability (CVE-2020-27223)

Moodle Permissions, Privileges, and Access Controls Vulnerability (CVE-2011-4300)

Severity

Medium

Classification

CVE-2014-5022 CWE-707

Tags

Missing Update Known Vulnerabilities