Webform Multiple File Upload module for Drupal 7.x contains a cross-site scripting (XSS) vulnerability in the file name renderer. An unauthenticated attacker can exploit this vulnerability by uploading a file with a malicious filename containing JavaScript code (e.g., "<img src=1 onerror=alert(document.domain)>") to a Webform node with a Multifile field where file type validation is disabled. This allows the execution of arbitrary scripts in the context of the victim's browser. The issue is present in a third-party library and has been addressed in a patch available at https://github.com/fyneworks/multifile/pull/44 . Users are advised to apply the provided patch or update to a fixed version of the module.
Datos: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Se publican tal como los indican las fuentes, en inglés.
| Fabricante | Producto | Versiones | |
|---|---|---|---|
| Drupal | Drupal | 7.x-1.0 – ≤ 7.x-1.6 | |
| webform multiple file upload project | webform multiple file upload | 7.x-1.2 |
cpe:2.3:a:webform_multiple_file_upload_project:webform_multiple_file_upload:7.x-1.2:*:*:*:*:drupal:*:*cpe:2.3:a:webform_multiple_file_upload_project:webform_multiple_file_upload:7.x-1.3:*:*:*:*:drupal:*:*cpe:2.3:a:webform_multiple_file_upload_project:webform_multiple_file_upload:7.x-1.4:*:*:*:*:drupal:*:*cpe:2.3:a:webform_multiple_file_upload_project:webform_multiple_file_upload:7.x-1.5:*:*:*:*:drupal:*:*cpe:2.3:a:webform_multiple_file_upload_project:webform_multiple_file_upload:7.x-1.6:*:*:*:*:drupal:*:*cpe:2.3:a:webform_multiple_file_upload_project:webform_multiple_file_upload:7.x-1.x:dev:*:*:*:drupal:*:*Nuestro sensor honeypot gratuito y de código abierto espera en puertos que su servidor no usa y reporta a una lista compartida los escáneres y atacantes que se conectan.