CVE-2016-7571

CWE-79 — Cross-site Scripting (XSS)4 documents4 sources

Severity

6.1MEDIUM

EPSS

0.4%

top 39.92%

CISA KEV

Not in KEV

Exploit

No known exploits

Affected products

Drupal Core Drupal Drupal

Timeline

PublishedOct 3

Latest updateMay 17

Description

Cross-site scripting (XSS) vulnerability in Drupal 8.x before 8.1.10 allows remote attackers to inject arbitrary web script or HTML via vectors involving an HTTP exception.

CVSS vector

CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:NExploitability: 2.8 | Impact: 2.7

Affected Packages3 packages

▶Packagistdrupal/core8.0 — 8.1.10

▶Packagistdrupal/drupal8.0 — 8.1.10

▶NVDdrupal/drupal17 versions+16

🔴Vulnerability Details

OSV

Drupal Cross-site scripting (XSS) vulnerability↗2022-05-17

▶

GHSA

Drupal Cross-site scripting (XSS) vulnerability↗2022-05-17

▶

CVEList

CVE-2016-7571: Cross-site scripting (XSS) vulnerability in Drupal 8↗2016-10-03

▶