CVE-2015-4387

Cross-site scripting (XSS) vulnerability in unspecified administration pages in the Password Policy module 6.x-1.x before 6.x-1.11 and 7.x-1.x before 7.x-1.11 for Drupal, when a site has a policy that uses the username constraint, allows remote attackers to inject arbitrary web script or HTML via a crafted username that is imported from an external source.
Configurations

Configuration 1 (hide)

OR cpe:2.3:a:password_policy_project:password_policy:6.x-1.0:*:*:*:*:drupal:*:*
cpe:2.3:a:password_policy_project:password_policy:6.x-1.1:*:*:*:*:drupal:*:*
cpe:2.3:a:password_policy_project:password_policy:6.x-1.2:*:*:*:*:drupal:*:*
cpe:2.3:a:password_policy_project:password_policy:6.x-1.3:*:*:*:*:drupal:*:*
cpe:2.3:a:password_policy_project:password_policy:6.x-1.4:*:*:*:*:drupal:*:*
cpe:2.3:a:password_policy_project:password_policy:6.x-1.5:*:*:*:*:drupal:*:*
cpe:2.3:a:password_policy_project:password_policy:6.x-1.6:*:*:*:*:drupal:*:*
cpe:2.3:a:password_policy_project:password_policy:6.x-1.7:*:*:*:*:drupal:*:*
cpe:2.3:a:password_policy_project:password_policy:6.x-1.8:*:*:*:*:drupal:*:*
cpe:2.3:a:password_policy_project:password_policy:6.x-1.9:*:*:*:*:drupal:*:*
cpe:2.3:a:password_policy_project:password_policy:6.x-1.10:*:*:*:*:drupal:*:*
cpe:2.3:a:password_policy_project:password_policy:7.x-1.0:*:*:*:*:drupal:*:*
cpe:2.3:a:password_policy_project:password_policy:7.x-1.1:*:*:*:*:drupal:*:*
cpe:2.3:a:password_policy_project:password_policy:7.x-1.2:*:*:*:*:drupal:*:*
cpe:2.3:a:password_policy_project:password_policy:7.x-1.3:*:*:*:*:drupal:*:*
cpe:2.3:a:password_policy_project:password_policy:7.x-1.4:*:*:*:*:drupal:*:*
cpe:2.3:a:password_policy_project:password_policy:7.x-1.5:*:*:*:*:drupal:*:*
cpe:2.3:a:password_policy_project:password_policy:7.x-1.6:*:*:*:*:drupal:*:*
cpe:2.3:a:password_policy_project:password_policy:7.x-1.7:*:*:*:*:drupal:*:*
cpe:2.3:a:password_policy_project:password_policy:7.x-1.8:*:*:*:*:drupal:*:*
cpe:2.3:a:password_policy_project:password_policy:7.x-1.9:*:*:*:*:drupal:*:*
cpe:2.3:a:password_policy_project:password_policy:7.x-1.10:*:*:*:*:drupal:*:*

History

No history.

Information

Published : 2015-06-15 14:59

Updated : 2015-06-26 16:01


NVD link : CVE-2015-4387

Mitre link : CVE-2015-4387

CVE.ORG link : CVE-2015-4387


JSON object : View

Products Affected

password_policy_project

  • password_policy
CWE
CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')