CVE-2012-3800

Cross-site scripting (XSS) vulnerability in og.js in the Organic Groups (OG) module 6.x-2.x before 6.x-2.4 for Drupal, when used with the Vertical Tabs module, allows remote authenticated users to inject arbitrary web script or HTML via vectors related the group title.

CVSS v2.0 NVD

2.1 LOWAV:N/AC:H/Au:S/C:N/I:P/A:N

EPSS

1.66% chance of exploitation in the next 30 days, 76th percentile

Published

2012-06-27

Updated

2024-08-06

Proof-of-concept exploits (1)

• http://drupalcode.org/project/og.git/commitdiff/d48fef5

Security advisories

• http://drupal.org/node/1619810
• http://secunia.com/advisories/49397
• http://drupal.org/node/1619736
• http://www.securityfocus.com/bid/53838

References

• CVE Record
• NVD entry