CVE-2018-7603
Last modified
CVE-2018-7603 is a vulnerability of currently unknown severity. In Drupal's 3rd party module search auto complete prior to versions 7.x-4.8 there is a Cross Site Scripting vulnerability. This Search Autocomplete module enables you to autocomplete textfield using data from your website (nodes, comments, etc.). EPSS estimates a 0.79% chance of exploitation in the next 30 days.
Description
In Drupal's 3rd party module search auto complete prior to versions 7.x-4.8 there is a Cross Site Scripting vulnerability. This Search Autocomplete module enables you to autocomplete textfield using data from your website (nodes, comments, etc.). The module doesn't sufficiently filter user-entered text among the autocompletion items leading to a Cross Site Scripting (XSS) vulnerability. This vulnerability can be exploited by any user allowed to create one of the autocompletion item, for instance, nodes, users, comments.
Metrics
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Search Autocomplete Project | Search Autocomplete | < 7.x-4.8 |
References
- https://www.drupal.org/sa-contrib-2018-070Patch, Vendor Advisory
- https://www.drupal.org/sa-contrib-2018-070Patch, Vendor Advisory
Timeline
- Published
- Last Modified
- Status
- Modified
Frequently Asked Questions
What is CVE-2018-7603?
How severe is CVE-2018-7603?
How do I fix CVE-2018-7603?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2018
- CVE-2018-7587An issue was discovered in CImg v.220. DoS occurs when loadi…
- CVE-2018-7588An issue was discovered in CImg v.220. A heap-based buffer o…
- CVE-2018-7589An issue was discovered in CImg v.220. A double free in load…
- CVE-2018-7590CSRF exists in Hoosk 1.7.0 via /admin/users/new/add, resulti…
- CVE-2018-7600Drupal before 7.58, 8.x before 8.3.9, 8.4.x before 8.4.6, an…9.8
- CVE-2018-7602A remote code execution vulnerability exists within multiple…9.8
- CVE-2018-7631Buffer Overflow in httpd in EpiCentro E_7.3.2+ allows attack…
- CVE-2018-7632Buffer Overflow in httpd in EpiCentro E_7.3.2+ allows attack…
- CVE-2018-7633Code injection in the /ui/login form Language parameter in E…
- CVE-2018-7634An issue was discovered in Enalean Tuleap 9.17. Lack of CSRF…
- CVE-2018-7635Whale Browser before 1.0.41.8 displays no URL information bu…
- CVE-2018-7636The URL filtering "continue page" hosted by PAN-OS 8.0.10 an…
Are you affected by CVE-2018-7603?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST