CVE-2012-5538

Published: Dec 3, 2012Modified: Apr 29, 2026

2.1

Vector

AV:N/AC:H/Au:S/C:N/I:P/A:N

Exploitability: 3.9 / Impact: 2.9

Source: NVD

Description

Cross-site scripting (XSS) vulnerability in the FileField Sources module 6.x-1.x before 6.x-1.6 and 7.x-1.x before 7.x-1.6 for Drupal, when the field has "Reference existing" source enabled, allows remote authenticated users to inject arbitrary web script or HTML via the filename of an uploaded file.

Affected (12)

Products: Nathan Haug: Filefield Sources

Nathan Haug

1 product

Filefield Sources

Configuration A

12 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Nathan Haug Filefield Sources	Version 6.x-1.0
Nathan Haug Filefield Sources	Version 6.x-1.1
Nathan Haug Filefield Sources	Version 6.x-1.2
Nathan Haug Filefield Sources	Version 6.x-1.3
Nathan Haug Filefield Sources	Version 6.x-1.4
Nathan Haug Filefield Sources	Version 6.x-1.5
Nathan Haug Filefield Sources	Version 6.x-1.x dev
Nathan Haug Filefield Sources	Version 7.x-1.2 beta1
Nathan Haug Filefield Sources	Version 7.x-1.3
Nathan Haug Filefield Sources	Version 7.x-1.4
Nathan Haug Filefield Sources	Version 7.x-1.5
Nathan Haug Filefield Sources	Version 7.x-1.x dev