Search

Find a vulnerability

Search criteria

    2 vulnerabilities found for 3rd party module - Search Autocomplete by Drupal

    CVE-2018-7603 (GCVE-0-2018-7603)

    Vulnerability from nvd – Published: 2019-01-15 22:00 – Updated: 2024-09-17 02:57
    VLAI
    Title
    Search Autocomplete
    Summary
    In Drupal's 3rd party module search auto complete prior to versions 7.x-4.8 there is a Cross Site Scripting vulnerability. This Search Autocomplete module enables you to autocomplete textfield using data from your website (nodes, comments, etc.). The module doesn't sufficiently filter user-entered text among the autocompletion items leading to a Cross Site Scripting (XSS) vulnerability. This vulnerability can be exploited by any user allowed to create one of the autocompletion item, for instance, nodes, users, comments.
    Severity
    No CVSS data available.
    CWE
    • A vulnerability in search auto complete a 3rd party Druapl contributed module. Search Autocomplete allows an attacker to execute javascript code to causing xss. Affected releases are Drupal 3rd party module - Search Autocomplete: versions prior to 7.x-4.8.
    Assigner
    References
    URL Tags
    https://www.drupal.org/sa-contrib-2018-070 x_refsource_CONFIRM
    Impacted products
    Vendor Product Version
    Drupal 3rd party module - Search Autocomplete Affected: 7.x-4.x , < 7.x-4.8 (custom)
    		Create a notification for this product.
    Credits
    Reported By: Simon Kapadia Fixed By: Dominique CLAUSE
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-05T06:31:04.972Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://www.drupal.org/sa-contrib-2018-070"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "3rd party module - Search Autocomplete",
          "vendor": "Drupal",
          "versions": [
            {
              "lessThan": "7.x-4.8",
              "status": "affected",
              "version": "7.x-4.x",
              "versionType": "custom"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "value": "Reported By: Simon Kapadia Fixed By: Dominique CLAUSE"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In Drupal\u0027s 3rd party module search auto complete prior to versions 7.x-4.8 there is a Cross Site Scripting vulnerability. This Search Autocomplete module enables you to autocomplete textfield using data from your website (nodes, comments, etc.). The module doesn\u0027t sufficiently filter user-entered text among the autocompletion items leading to a Cross Site Scripting (XSS) vulnerability. This vulnerability can be exploited by any user allowed to create one of the autocompletion item, for instance, nodes, users, comments."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "A vulnerability in search auto complete a 3rd party Druapl contributed module. Search Autocomplete allows an attacker to execute javascript code to causing xss.  Affected releases are Drupal 3rd party module - Search Autocomplete: versions prior to 7.x-4.8.",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2019-01-15T21:57:01.000Z",
        "orgId": "2c85b837-eb8b-40ed-9d74-228c62987387",
        "shortName": "drupal"
      },
      "references": [
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://www.drupal.org/sa-contrib-2018-070"
        }
      ],
      "source": {
        "advisory": "https://www.drupal.org/sa-contrib-2018-070",
        "discovery": "UNKNOWN"
      },
      "title": "Search Autocomplete",
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "AKA": "",
          "ASSIGNER": "security@drupal.org",
          "DATE_PUBLIC": "",
          "ID": "CVE-2018-7603",
          "STATE": "PUBLIC",
          "TITLE": "Search Autocomplete"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "3rd party module - Search Autocomplete",
                      "version": {
                        "version_data": [
                          {
                            "affected": "\u003c",
                            "platform": "",
                            "version_affected": "\u003c",
                            "version_name": "7.x-4.x",
                            "version_value": "7.x-4.8"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "Drupal"
              }
            ]
          }
        },
        "configuration": [],
        "credit": [
          {
            "lang": "eng",
            "value": "Reported By: Simon Kapadia Fixed By: Dominique CLAUSE"
          }
        ],
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "In Drupal\u0027s 3rd party module search auto complete prior to versions 7.x-4.8 there is a Cross Site Scripting vulnerability. This Search Autocomplete module enables you to autocomplete textfield using data from your website (nodes, comments, etc.). The module doesn\u0027t sufficiently filter user-entered text among the autocompletion items leading to a Cross Site Scripting (XSS) vulnerability. This vulnerability can be exploited by any user allowed to create one of the autocompletion item, for instance, nodes, users, comments."
            }
          ]
        },
        "exploit": [],
        "impact": {
          "cvss": {
            "attackComplexity": "HIGH",
            "attackVector": "PHYSICAL",
            "availabilityImpact": "NONE",
            "baseScore": 0,
            "baseSeverity": "NONE",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "HIGH",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.0/AV:P/AC:H/PR:H/UI:R/S:U/C:N/I:N/A:N",
            "version": "3.0"
          }
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "A vulnerability in search auto complete a 3rd party Druapl contributed module. Search Autocomplete allows an attacker to execute javascript code to causing xss.  Affected releases are Drupal 3rd party module - Search Autocomplete: versions prior to 7.x-4.8."
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://www.drupal.org/sa-contrib-2018-070",
              "refsource": "CONFIRM",
              "url": "https://www.drupal.org/sa-contrib-2018-070"
            }
          ]
        },
        "solution": [],
        "source": {
          "advisory": "https://www.drupal.org/sa-contrib-2018-070",
          "defect": [],
          "discovery": "UNKNOWN"
        },
        "work_around": []
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "2c85b837-eb8b-40ed-9d74-228c62987387",
    "assignerShortName": "drupal",
    "cveId": "CVE-2018-7603",
    "datePublished": "2019-01-15T22:00:00.000Z",
    "dateReserved": "2018-03-01T00:00:00.000Z",
    "dateUpdated": "2024-09-17T02:57:47.547Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

    CVE-2018-7603 (GCVE-0-2018-7603)

    Vulnerability from cvelistv5 – Published: 2019-01-15 22:00 – Updated: 2024-09-17 02:57
    VLAI
    Title
    Search Autocomplete
    Summary
    In Drupal's 3rd party module search auto complete prior to versions 7.x-4.8 there is a Cross Site Scripting vulnerability. This Search Autocomplete module enables you to autocomplete textfield using data from your website (nodes, comments, etc.). The module doesn't sufficiently filter user-entered text among the autocompletion items leading to a Cross Site Scripting (XSS) vulnerability. This vulnerability can be exploited by any user allowed to create one of the autocompletion item, for instance, nodes, users, comments.
    Severity
    No CVSS data available.
    CWE
    • A vulnerability in search auto complete a 3rd party Druapl contributed module. Search Autocomplete allows an attacker to execute javascript code to causing xss. Affected releases are Drupal 3rd party module - Search Autocomplete: versions prior to 7.x-4.8.
    Assigner
    References
    URL Tags
    https://www.drupal.org/sa-contrib-2018-070 x_refsource_CONFIRM
    Impacted products
    Vendor Product Version
    Drupal 3rd party module - Search Autocomplete Affected: 7.x-4.x , < 7.x-4.8 (custom)
    		Create a notification for this product.
    Credits
    Reported By: Simon Kapadia Fixed By: Dominique CLAUSE
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-05T06:31:04.972Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://www.drupal.org/sa-contrib-2018-070"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "3rd party module - Search Autocomplete",
          "vendor": "Drupal",
          "versions": [
            {
              "lessThan": "7.x-4.8",
              "status": "affected",
              "version": "7.x-4.x",
              "versionType": "custom"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "value": "Reported By: Simon Kapadia Fixed By: Dominique CLAUSE"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In Drupal\u0027s 3rd party module search auto complete prior to versions 7.x-4.8 there is a Cross Site Scripting vulnerability. This Search Autocomplete module enables you to autocomplete textfield using data from your website (nodes, comments, etc.). The module doesn\u0027t sufficiently filter user-entered text among the autocompletion items leading to a Cross Site Scripting (XSS) vulnerability. This vulnerability can be exploited by any user allowed to create one of the autocompletion item, for instance, nodes, users, comments."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "A vulnerability in search auto complete a 3rd party Druapl contributed module. Search Autocomplete allows an attacker to execute javascript code to causing xss.  Affected releases are Drupal 3rd party module - Search Autocomplete: versions prior to 7.x-4.8.",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2019-01-15T21:57:01.000Z",
        "orgId": "2c85b837-eb8b-40ed-9d74-228c62987387",
        "shortName": "drupal"
      },
      "references": [
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://www.drupal.org/sa-contrib-2018-070"
        }
      ],
      "source": {
        "advisory": "https://www.drupal.org/sa-contrib-2018-070",
        "discovery": "UNKNOWN"
      },
      "title": "Search Autocomplete",
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "AKA": "",
          "ASSIGNER": "security@drupal.org",
          "DATE_PUBLIC": "",
          "ID": "CVE-2018-7603",
          "STATE": "PUBLIC",
          "TITLE": "Search Autocomplete"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "3rd party module - Search Autocomplete",
                      "version": {
                        "version_data": [
                          {
                            "affected": "\u003c",
                            "platform": "",
                            "version_affected": "\u003c",
                            "version_name": "7.x-4.x",
                            "version_value": "7.x-4.8"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "Drupal"
              }
            ]
          }
        },
        "configuration": [],
        "credit": [
          {
            "lang": "eng",
            "value": "Reported By: Simon Kapadia Fixed By: Dominique CLAUSE"
          }
        ],
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "In Drupal\u0027s 3rd party module search auto complete prior to versions 7.x-4.8 there is a Cross Site Scripting vulnerability. This Search Autocomplete module enables you to autocomplete textfield using data from your website (nodes, comments, etc.). The module doesn\u0027t sufficiently filter user-entered text among the autocompletion items leading to a Cross Site Scripting (XSS) vulnerability. This vulnerability can be exploited by any user allowed to create one of the autocompletion item, for instance, nodes, users, comments."
            }
          ]
        },
        "exploit": [],
        "impact": {
          "cvss": {
            "attackComplexity": "HIGH",
            "attackVector": "PHYSICAL",
            "availabilityImpact": "NONE",
            "baseScore": 0,
            "baseSeverity": "NONE",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "HIGH",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.0/AV:P/AC:H/PR:H/UI:R/S:U/C:N/I:N/A:N",
            "version": "3.0"
          }
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "A vulnerability in search auto complete a 3rd party Druapl contributed module. Search Autocomplete allows an attacker to execute javascript code to causing xss.  Affected releases are Drupal 3rd party module - Search Autocomplete: versions prior to 7.x-4.8."
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://www.drupal.org/sa-contrib-2018-070",
              "refsource": "CONFIRM",
              "url": "https://www.drupal.org/sa-contrib-2018-070"
            }
          ]
        },
        "solution": [],
        "source": {
          "advisory": "https://www.drupal.org/sa-contrib-2018-070",
          "defect": [],
          "discovery": "UNKNOWN"
        },
        "work_around": []
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "2c85b837-eb8b-40ed-9d74-228c62987387",
    "assignerShortName": "drupal",
    "cveId": "CVE-2018-7603",
    "datePublished": "2019-01-15T22:00:00.000Z",
    "dateReserved": "2018-03-01T00:00:00.000Z",
    "dateUpdated": "2024-09-17T02:57:47.547Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}