CVE-2012-2717

Severity: medium (CVSS 4.3 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 2.5% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2012-06-27 · updated 2026-06-16
Weakness: CWE-79

Description

Multiple cross-site scripting (XSS) vulnerabilities in the Mobile Tools module 6.x-2.x before 6.x-2.3 for Drupal allow remote attackers to inject arbitrary web script or HTML via the (1) Mobile URL field or (2) Desktop URL field to the General configuration page, or the (3) message to the Mobile Tools block message options.

Affected products

Mathew Winstone Mobile Tools: 6.x-2.0, 6.x-2.1, 6.x-2.2, 6.x-2.x-dev

References

http://drupal.org/node/1169008
http://drupal.org/node/1608828
http://drupalcode.org/project/mobile_tools.git/commitdiff/614b0fc
http://osvdb.org/82410
http://secunia.com/advisories/49318
http://www.madirish.net/content/drupal-mobile-tools-6x-23-xss
http://www.openwall.com/lists/oss-security/2012/06/14/3
http://www.securityfocus.com/bid/53734
https://exchange.xforce.ibmcloud.com/vulnerabilities/76002
http://drupal.org/node/1169008
http://drupal.org/node/1608828
http://drupalcode.org/project/mobile_tools.git/commitdiff/614b0fc

Get alerted when CVE-2012-2717 or the next vulnerability affects your stack