CVE-2012-3800

Severity: low (CVSS 2.1 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.7% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2012-06-27 · updated 2026-06-16
Weakness: CWE-79

Description

Cross-site scripting (XSS) vulnerability in og.js in the Organic Groups (OG) module 6.x-2.x before 6.x-2.4 for Drupal, when used with the Vertical Tabs module, allows remote authenticated users to inject arbitrary web script or HTML via vectors related the group title.

Affected products

Moshe Weitzman Organic Groups: 6.x-2.0, 6.x-2.0-rc1, 6.x-2.0-rc2, 6.x-2.0-rc3, 6.x-2.1, 6.x-2.2 (+2)

References

http://drupal.org/node/1619736
http://drupal.org/node/1619810
http://drupalcode.org/project/og.git/commitdiff/d48fef5
http://secunia.com/advisories/49397
http://www.openwall.com/lists/oss-security/2012/06/14/3
http://www.osvdb.org/82712
http://www.securityfocus.com/bid/53838
https://exchange.xforce.ibmcloud.com/vulnerabilities/76149
http://drupal.org/node/1619736
http://drupal.org/node/1619810
http://drupalcode.org/project/og.git/commitdiff/d48fef5
http://secunia.com/advisories/49397

Get alerted when CVE-2012-3800 or the next vulnerability affects your stack