CVE-2013-0324

Severity: low (CVSS 2.1 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.9% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2013-03-27 · updated 2026-06-16
Weakness: CWE-79

Description

Cross-site scripting (XSS) vulnerability in the Rendered links formatter in the Menu Reference module 7.x-1.x before 7.x-1.0 for Drupal allows remote authenticated users with the "Administer menus and menu items" permission to inject arbitrary web script or HTML via the menu link title.

Affected products

Tomasbarej Menu Reference: 7.x-1.x-dev

References

http://drupal.org/node/1922434
http://drupal.org/node/1922446
http://drupalcode.org/project/menu_reference.git/commitdiff/7e7367d
http://www.openwall.com/lists/oss-security/2013/02/21/5
http://drupal.org/node/1922434
http://drupal.org/node/1922446
http://drupalcode.org/project/menu_reference.git/commitdiff/7e7367d
http://www.openwall.com/lists/oss-security/2013/02/21/5

Get alerted when CVE-2013-0324 or the next vulnerability affects your stack