CVE-2018-7603
N/A
N/A
Summary
In Drupal's 3rd party module search auto complete prior to versions 7.x-4.8 there is a Cross Site Scripting vulnerability. This Search Autocomplete module enables you to autocomplete textfield using data from your website (nodes, comments, etc.). The module doesn't sufficiently filter user-entered text among the autocompletion items leading to a Cross Site Scripting (XSS) vulnerability. This vulnerability can be exploited by any user allowed to create one of the autocompletion item, for instance, nodes, users, comments.
Affected Software
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| Drupal | 3rd party module - Search Autocomplete | 7.x-4.x < 7.x-4.8 | affected |
Weaknesses
- A vulnerability in search auto complete a 3rd party Druapl contributed module. Search Autocomplete allows an attacker to execute javascript code to causing xss. Affected releases are Drupal 3rd party module - Search Autocomplete: versions prior to 7.x-4.8.
ADP Enrichment
CVE Program Container
Additional References
References
Feedback
Was this page helpful?
Glad to hear it! Please tell us how we can improve.
Sorry to hear that. Please tell us how we can improve.