CVE-2012-2712

Severity: low (CVSS 2.6 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 2.2% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2012-06-27 · updated 2026-06-16
Weakness: CWE-79

Description

Multiple cross-site scripting (XSS) vulnerabilities in the Search API module 7.x-1.x before 7.x-1.1 for Drupal, when supporting manual entry of field identifiers, allow remote attackers to inject arbitrary web script or HTML via vectors related to thrown exceptions and logging errors.

Affected products

Thomas Seidl Search Api: 7.x-1.0, 7.x-1.0-beta1, 7.x-1.0-beta10, 7.x-1.0-beta2, 7.x-1.0-beta3, 7.x-1.0-beta4 (+7)

References

http://drupal.org/node/1596524
http://drupal.org/node/1597364
http://drupalcode.org/project/search_api.git/commitdiff/5a18c8c
http://secunia.com/advisories/49236
http://www.openwall.com/lists/oss-security/2012/06/14/3
http://www.osvdb.org/82230
http://www.securityfocus.com/bid/53672
https://exchange.xforce.ibmcloud.com/vulnerabilities/75868
http://drupal.org/node/1596524
http://drupal.org/node/1597364
http://drupalcode.org/project/search_api.git/commitdiff/5a18c8c
http://secunia.com/advisories/49236

Get alerted when CVE-2012-2712 or the next vulnerability affects your stack