CVE-2015-3361

Published: Apr 21, 2015Modified: May 6, 2026

2.1

Vector

AV:N/AC:H/Au:S/C:N/I:P/A:N

Exploitability: 3.9 / Impact: 2.9

Source: NVD

Description

Cross-site scripting (XSS) vulnerability in the Linkit module before 7.x-2.7 and 7.x-3.x before 7.x-3.3 for Drupal, when the node search plugin is enabled, allows remote authenticated users to inject arbitrary web script or HTML via a node title.

Affected (2)

Products: Linkit Project: Linkit

Linkit Project

1 product

Linkit

Configuration A

2 vulnerable

Vulnerable Software	Affected Versions
Linkit Project Linkit	From 7.x-1.0 to 7.x-2.7
Linkit Project Linkit	From 7.x-3.0 to 7.x-3.3

Related CWEs

CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

References (10)

http://www.openwall.com/lists/oss-security/2015/01/29/6

Source: cve@mitre.org

Mailing List

http://www.securityfocus.com/bid/71959

Source: cve@mitre.org

Third Party AdvisoryVDB Entry

https://www.drupal.org/node/2402855

Source: cve@mitre.org

Patch

https://www.drupal.org/node/2402859

Source: cve@mitre.org

Patch

https://www.drupal.org/node/2403459

Source: cve@mitre.org

PatchVendor Advisory

http://www.openwall.com/lists/oss-security/2015/01/29/6